Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to specify multiple buckets in a bucketpolicy in a cfn template?

The following is an example of setting a bucketpolicy in a cfn template for A bucket.

"mybucketpolicy" : {
   "Type" : "AWS::S3::BucketPolicy",
   "Properties" : {
      "PolicyDocument" : {
         "Id" : "MyPolicy",
         "Statement" : [ {
            "Sid" : "ReadAccess",
            "Action" : [ "s3:GetObject" ],
            "Effect" : "Allow",
            "Resource" : { "Fn::Join" : [
                  "", [ "arn:aws:s3:::", { "Ref" : "mybucket" } , "/*" ]
               ] },
            "Principal" : {
               "AWS" : { "Fn::GetAtt" : [ "mygroup", "Arn" ] }
            }
         } ]
      },
      "Bucket" : { "Ref" : "mybucket" }
      }
   }
}

If I want to apply a policy to another bucket, in addition to mybucket, how would I do that?

Do I have to:

  1. create a brand new bucketpolicy lets say 'mybucketpolicy2' which would be very similar to the above?
  2. just add one more item to the 'Statement' array above with the new bucket name? If yes, then this would be in conflict with the "Bucket" key above, wont it?
  3. some other way?

PS: I have asked the same question on aws cfn forum but I have come to realize that I get answers quicker on SO than on aws forums.

like image 491
Silent User Avatar asked Mar 08 '13 19:03

Silent User


People also ask

How do you restrict few users and allow few users to access S3 bucket?

You can use the NotPrincipal element of an IAM or S3 bucket policy to limit resource access to a specific set of users. This element allows you to block all users who are not defined in its value array, even if they have an Allow in their own IAM user policies.


1 Answers

You can't attach a AWS::S3::BucketPolicy resource to more than one bucket. To attach a policy to more than one resource you will need to use IAM resources. The AWS::IAM::Policy resource is used for defining policies through IAM management and applying them to various resources. In my opinion the IAM interface is much more powerful and flexible than the old-style policy resources (but is more complicated). Not only can you have a single policy applied to more than one bucket, but you can also have multiple policies (statements) applied to multiple buckets and assigned to multiple IAM users/groups/roles.

You grant access to the specific policy using IAM groups or users that could be created in your CloudFormation template using eg. AWS::IAM::Group resources.

Adapt this snippet to your needs:

"GetS3ContentPolicy" : {
  "Type" : "AWS::IAM::Policy",
  "Properties" : {
    "PolicyName" : "S3ContentPolicy",
    "PolicyDocument" : {
      "Statement" : [ {
        "Effect" : "Allow",
        "Action" : [
          "s3:ListBucket"
        ],
        "Resource" : [ 
          { "Fn::Join" : ["", [ "arn:aws:s3:::", { "Ref" : "PubS3Bucket" } ] ] },
          { "Fn::Join" : ["", [ "arn:aws:s3:::", { "Ref" : "SecretS3Bucket" } ] ] }
        ]
      },
      {
        "Effect" : "Allow",
        "Action" : [
          "s3:GetObject",
          "s3:GetObjectVersion"
        ],
        "Resource" : [ 
          { "Fn::Join" : ["", [ "arn:aws:s3:::", { "Ref" : "PubS3Bucket" }, "/*" ] ] },
          { "Fn::Join" : ["", [ "arn:aws:s3:::", { "Ref" : "SecretS3Bucket" }, "/*" ] ] }
        ]
      } ]
    },
    "Groups" : [
      { "Ref" : "ManagementInstancesGroup" },
      { "Ref" : "WebInstancesGroup" }
    ]
  }
},
like image 186
zorlem Avatar answered Oct 15 '22 03:10

zorlem