How to manage groups for access to buckets in Amazon S3

Question

How to manage groups for access to buckets in Amazon S3

Navigation

#1 by (0 votes)

0

I am developing a serverless app on AWS with the javascript API in angular 4, I have a bucket mi-bucket in S3 with one folder per client ( mi-bucket/cliente1 , mi-bucket/cliente2 ).

I have created a userPool cargaArchivosPool in amazon Cognito with email and password as necessary attributes and a custom attribute nombre_carpeta . The users created them through the Cognito console in AWS and the attribute nombre_carpeta was added by the AWS-cli.

I also created an IdentityPool with the roles AuthRole and NoAuthRole . The role AuthRole I assigned a policy in the following way:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Action": [
            "s3:ListBucket"
        ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::mi-bucket"
        ]
    },
    {
        "Action": [
            "s3:*"
        ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::mi-bucket/*"
        ]
    }
    ]
}

and there to each user I associate a group with a policy with permission to read and edit on a single folder inside the bucket in the following way:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Action": [
            "s3:ListBucket"
        ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:s3:::mi-bucket"
        ],
        "Condition": {
            "StringEquals": {
                "s3:prefix": [
                    "",
                    "cliente1/"
                ],
                "s3:delimiter": [
                    "/"
                ]
            }
        }
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::mi-bucket/cliente1/*"
        ]
    }
]
}

And so also for each client. When I connect with a client I can do read and write operations on the whole bucket, but the permissions specific to each client do not apply, that is, if from the browser I change the name of the custom attribute nombre_carpeta for the cliente1 write to folders to which you do not have permissions according to the group policy in the userPool. How can I control that each user only has permissions on a particular folder?

I appreciate your help

javascript angular4 aws amazon-s3

asked by FelipeM 09.11.2017 в 00:10

source

1 answer

change form route laravel 5.4 with jquery Problem with the greenDAO jar plugin

score 0 · Answer 1

In my opinion there are no problems with what you have described. Are you sure that users do not have the same policy associated with AutRole ?

You could complete the access policy of each user with a denial of the style:

{
     "Sid": "SinAccesoParaCarpetasAjenas",
     "Effect": "Deny",
     "Action": ["s3:*"],
     "Resource": ["arn:aws:s3:::mi-bucket/*"],
     "Condition": {
         "StringNotLike": {
             "s3:prefix": "mi-bucket/cliente1/*"
         }
      }
}

Mind you, I have not tested it in your specific context but in my experience the access policy will be more secure with a clause similar to this one.