The following is an example of setting a bucketpolicy in a cfn template for A bucket.
"mybucketpolicy" : {
"Type" : "AWS::S3::BucketPolicy",
"Properties" : {
"PolicyDocument" : {
"Id" : "MyPolicy",
"Statement" : [ {
"Sid" : "ReadAccess",
"Action" : [ "s3:GetObject" ],
"Effect" : "Allow",
"Resource" : { "Fn::Join" : [
"", [ "arn:aws:s3:::", { "Ref" : "mybucket" } , "/*" ]
] },
"Principal" : {
"AWS" : { "Fn::GetAtt" : [ "mygroup", "Arn" ] }
}
} ]
},
"Bucket" : { "Ref" : "mybucket" }
}
}
}
If I want to apply a policy to another bucket, in addition to mybucket, how would I do that?
Do I have to:
PS: I have asked the same question on aws cfn forum but I have come to realize that I get answers quicker on SO than on aws forums.
You can use the NotPrincipal element of an IAM or S3 bucket policy to limit resource access to a specific set of users. This element allows you to block all users who are not defined in its value array, even if they have an Allow in their own IAM user policies.
You can't attach a AWS::S3::BucketPolicy resource to more than one bucket. To attach a policy to more than one resource you will need to use IAM resources. The AWS::IAM::Policy resource is used for defining policies through IAM management and applying them to various resources. In my opinion the IAM interface is much more powerful and flexible than the old-style policy resources (but is more complicated). Not only can you have a single policy applied to more than one bucket, but you can also have multiple policies (statements) applied to multiple buckets and assigned to multiple IAM users/groups/roles.
You grant access to the specific policy using IAM groups or users that could be created in your CloudFormation template using eg. AWS::IAM::Group resources.
Adapt this snippet to your needs:
"GetS3ContentPolicy" : {
"Type" : "AWS::IAM::Policy",
"Properties" : {
"PolicyName" : "S3ContentPolicy",
"PolicyDocument" : {
"Statement" : [ {
"Effect" : "Allow",
"Action" : [
"s3:ListBucket"
],
"Resource" : [
{ "Fn::Join" : ["", [ "arn:aws:s3:::", { "Ref" : "PubS3Bucket" } ] ] },
{ "Fn::Join" : ["", [ "arn:aws:s3:::", { "Ref" : "SecretS3Bucket" } ] ] }
]
},
{
"Effect" : "Allow",
"Action" : [
"s3:GetObject",
"s3:GetObjectVersion"
],
"Resource" : [
{ "Fn::Join" : ["", [ "arn:aws:s3:::", { "Ref" : "PubS3Bucket" }, "/*" ] ] },
{ "Fn::Join" : ["", [ "arn:aws:s3:::", { "Ref" : "SecretS3Bucket" }, "/*" ] ] }
]
} ]
},
"Groups" : [
{ "Ref" : "ManagementInstancesGroup" },
{ "Ref" : "WebInstancesGroup" }
]
}
},
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With