S3 bucket policy IAM role showing up as API key

Question

I have an S3 bucket on which I am trying to apply the bucket policy via CloudFormation. I want to allow two IAM roles to access the bucket and is achieved by specifying the ARN of the roles in the bucket policy in the CloudFormation template. Below is the CloudFormation template:

LandingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref LandingBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          # yamllint disable-line rule:line-length
          - Sid: "Allow s3 permission"
            Action:
              - s3:PutObject
              - s3:GetObject
              - s3:ListBucket
            Effect: "Allow"
            Resource:
              - !GetAtt LandingBucket.Arn
              - !Sub "${LandingBucket.Arn}/*"
            Principal:
              AWS:
                - !Ref IamRoleArn1
                - !Ref IamRoleArn2

Parameters are: IamRoleArn1: arn:aws:iam::1234:role/xyz, IamRoleArn2: arn:aws:iam::1234:role/abc

The final policy from the console looks like below

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "file drop permission",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::1234:role/xyz",
                    "AROxxIECxx"
                ]
            },
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ]
        }
    ]
}

The first Principal is an IAM role, however, the second one looks like an API key even though in the CloudFormation template I have mentioned the second IAM role ARN just like the first IAM role.

Why is the second role ARN not showing up in the bucket policy?

@Marcin I have added the cloudformation template to the question — Mithun Manohar
From what you posted everything seems correct. I would double check if your question is fully representative of your real code that you use. — Marcin
The parameters you have shown are both called IamRoleArn1 -- shouldn't one of them be IamRoleArn2? — John Rotenstein
AROxxIECxx (unique id) usually shows up if you refer to a resource that is deleted after it was referenced. It looks like IamRoleArn2 is referring to a role that is/was deleted. — Asdfg

Rohith Joseph Rohith Joseph · Accepted Answer · 2021-05-25T03:52:36

That is the unique identifier of that particular resource. In this case it is called a RoleId and ARN is just a readable format of the same. Both representation points to the same resource in AWS. Try running

 aws iam get-role --role-name "<you role here>"

the output of this command will have a field named RoleId and should that should clear things out for you.

The unique identifier that starts with AROA represents that it is a role related resource.

S3 bucket policy IAM role showing up as API key

1 Answers