AWS IAM - Can you use multiple wildcards (*) in a value

Question

In all of the IAM Policy examples, they mention using wildcards (*) as placeholders for "stuff". However, the examples always use them at the end, and/or only demonstrate with one wildcard (e.g. to list everything in folder "xyz" with .../xyz/*).

I can't find anything definitive regarding the use of multiple wildcards, for example to match anything in subfolders across multiple buckets:

arn:aws:s3:::mynamespace-property*/logs/*

to allow something to see any log files across a "production" (mynamespace-property-prod) and "sandbox" (mynamespace-property-sand) bucket.

Answer 1

Not sure, but "all of a sudden" (you know what I'm talking about) it's working in the policy simulator with:

• Policy 1: "allow specific S3 permissions on any bucket" (e.g. an editor role)
• Policy 2: "deny all S3 actions unless in a user's folder across buckets" (i.e. can only see their files)

Where 'Policy 2' is:

{     "Version": "2012-10-17",     "Statement": [         {             "Sid": "ExplicitlyDenyAnythingExceptOwnNamedFolder",             "Action": [                 "s3:*"             ],             "Effect": "Deny",             "NotResource": [                 "arn:aws:s3:::mynamespace-property*/subfolder/${aws:username}/*"             ]         }     ] } 

---

As a sidenote, be aware that arn:aws:s3:::mynamespace-property*/${aws:username}/* (no explicit subfolder) will match both with and without "intervening" subfolders:

• arn:aws:s3:::mynamespace-property-suffix/subfolder/theuser/files..."
• arn:aws:s3:::mynamespace-property-suffix/theuser/files..."

Answer 2

Yes, It will work

From the documentation:

You can use wildcards as part of the resource ARN. You can use wildcard characters (* and ?) within any ARN segment (the parts separated by colons). An asterisk (*) represents any combination of characters and a question mark (?) represents any single character. You can have use multiple * or ? characters in each segment, but a wildcard cannot span segments.

I am going to say the "You can have use multiple " is a typo in the doc and they mean "you can use".