I'm trying to set up a little bit more complicated S3 Access Setup in Amazon Web Services S3.
The environment consists of the following:
Account A
- User/Role X
Account B
- User/Role Y
Account C
- User/Role Z
- Bucket 1
User/Role X, Y and Z have the "AdminstratorAccess"-Policy attached:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}
On Bucket 1 is the following Bucket-Policy mapped:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AddPermGet",
"Effect": "Allow",
"Principal": {
"AWS": [ "arn:aws:iam::ACCCOUNT-B:user/someuser" ]
},
"Action": [
"s3:PutObject",
"s3:PutObjectAcl"
],
"Resource": "arn:aws:s3:::s3bucket/*"
},
{
"Sid": "AddPermGet",
"Effect": "Allow",
"Principal": {
"AWS": [ "arn:aws:iam::ACCCOUNT-A:user/someuser" ]
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::s3bucket/*"
},
{
"Sid": "AddPermList",
"Effect": "Allow",
"Principal": {
"AWS": [ "arn:aws:iam::ACCCOUNT-A:user/someuser" ]
},
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::s3bucket"
}
]
}
Definition:
Account C is Owner of Bucket 1
My Tests:
uploading a file with user/role Z of Account C in Bucket 1 --> accessible for everyone granted in bucket policy --> User X and Z can access the file
uploading a file with user/role Y of Account B to Bucket 1 --> accessible only for user/role Y regardles of bucket policy content
uploading a file with user/role Y of Account B to Bucket 1 with "bucket-owner-full-control" (as defined in http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) --> accessible only for user/role Y and Z - but X gets: fatal error: An error occured (403) when calling the HeadObject operation: Forbidden. A list bucket works for all Users including X.
I'd like to reach, that a file uploaded by user/role Y of Account B to Bucket 1 has the same behaviour as user/role Z of Account C (the owner of the bucket) would upload the file. Clearly: I need access defined by the Policy, not by the File itself. Is it possible to enable "inheritance"?
Cheers, Matthias