IAM AWS S3 to restrict to a specific sub-folder

Question

I'm using AWS S3 component to store files.

I have a bucket called "mybucket" and with the following folders :

+---Mybucket
\---toto1
\---toto2
+---toto3
|   \--- subfolder
|       \---subsubfolder
\---toto4

I have AWS console users that need only need to access "toto3" folder.

I tried to restrict the access to this folder, but the user must have the right to list the root of bucket. If I put additional rights to acces the root folder, users can browser "toto1" and "toto2" folders and I don't want.

I want to configure something like that:

• Authorize to list all buckets of my S3 account (listAllBuckets policy)
• Autorize to list the root of the bucket (it's OK for me if the user see the directories names)
• Deny access for all prefix bucket different from "toto3"
• Autorize every actions for the user in toto3 folder
• I don't want to write an inclusive rules

I tried this IAM policy without any success :

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": ["arn:aws:s3:::mybucket/toto3/*"]
        },
        {
            "Sid": "Stmt1457617383000",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket"
            ],
            "Resource": ["arn:aws:s3:::mybucket"]
        },
        {
            "Sid": "Stmt1457617230000",
            "Effect": "Deny",
            "Action": ["s3:*"],
            "Condition": {
                "StringNotLike": {
                    "s3:prefix": "toto3*"
                }
            },
            "Resource": [
                "arn:aws:s3:::mybucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Answer 1

Here's a policy that will work for you:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::mybucket/toto3/*"
            ]
        },
        {
            "Sid": "Stmt1457617230000",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "",
                        "toto3/"
                    ]
                }
            },
            "Resource": [
                "arn:aws:s3:::mybucket*"
            ]
        }
    ]
}

Details:

• ListAllMyBuckets is required by the Console. It shows a list of all buckets.
• Any action permitted within the toto3/ path.
• ListBucket (retrieve objects list) permitted in the root of the bucket and in the toto3/ path.

I successfully tested this solution.

AWS Documentation Reference: Allow Users to Access a Personal "Home Directory" in Amazon S3