AWS S3 Bucket Policy - Principle SyntaxMake a bucket public in Amazon S3Downloading an entire S3 bucket?How to use AWS Lambda to backup an S3 object to a bucket on another account?CREATE_FAILED Bucketpolicy - Unknown field Fn::JoinAWS presigned url acl public read invalid signatureCross account S3 access through CloudFormation CLiCreate Policy in Cloudformation Granting Access to s3 Buckets From Separate AWS Accountboto3 giving 403s: Do we need to modify anything to have boto3 S3 work across S3 regions?AWS IAM Organization Issue - I can't see IAM users or any bucketsAWS S3 Bucket Policy with Empty Principle Array
reverse a list of generic type
Worms crawling under skin
Is it right to extend flaps only in the white arc?
Idiom for "I came, I saw, I ate" (or drank)
What is the meaning of word 'crack' in chapter 33 of A Game of Thrones?
Guitar tuning (EADGBE), "perfect" fourths?
Resolving moral conflict
I reverse the source code, you negate the output!
Is it impolite to ask for halal food when traveling to and in Thailand?
Is it a good idea to leave minor world details to the reader's imagination?
Performance for simple code that converts a RGB tuple to hex string
Transforming 2D points on to a regular grid or lattice
What is the lowest voltage that a microcontroller can successfully read on the analog pin?
Social leper versus social leopard
How can I repair this gas leak on my new range? Teflon tape isn't working
Find missing number in the transformation
I feel like most of my characters are the same, what can I do?
What is this utensil for?
How much damage can be done just by heating matter?
Allocating credit card points
My 15 year old son is gay. How do I express my feelings about this?
In a folk jam session, when asked which key my non-transposing chromatic instrument (like a violin) is in, what do I answer?
Conditionally execute a command if a specific package is loaded
How do I deal with too many NPCs in my campaign?
AWS S3 Bucket Policy - Principle Syntax
Make a bucket public in Amazon S3Downloading an entire S3 bucket?How to use AWS Lambda to backup an S3 object to a bucket on another account?CREATE_FAILED Bucketpolicy - Unknown field Fn::JoinAWS presigned url acl public read invalid signatureCross account S3 access through CloudFormation CLiCreate Policy in Cloudformation Granting Access to s3 Buckets From Separate AWS Accountboto3 giving 403s: Do we need to modify anything to have boto3 S3 work across S3 regions?AWS IAM Organization Issue - I can't see IAM users or any bucketsAWS S3 Bucket Policy with Empty Principle Array
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
Right now I have my policy defined on my S3 bucket but it seems like the principles I have defined are root and when someone under an account who isn't root isn't falling into the allow part of the policy
"Principal":
"AWS": [
"arn:aws:iam::123:root",
"arn:aws:iam::456:root",
"arn:aws:iam::789:root",
"arn:aws:iam::101:root"
]
,
I tired to specify it as
"arn:aws:iam::123:*"
but that doesn't work.
I also tried arn:aws:iam::123:user/sample@yahoo.com but that too doesn't seem to be correct as it fails with Invalid principal in policy
amazon-web-services amazon-s3
asked Mar 28 at 15:59
TonyTony
2,2137 gold badges19 silver badges34 bronze badges
add a comment
|
Right now I have my policy defined on my S3 bucket but it seems like the principles I have defined are root and when someone under an account who isn't root isn't falling into the allow part of the policy
"Principal":
"AWS": [
"arn:aws:iam::123:root",
"arn:aws:iam::456:root",
"arn:aws:iam::789:root",
"arn:aws:iam::101:root"
]
,
I tired to specify it as
"arn:aws:iam::123:*"
but that doesn't work.
I also tried arn:aws:iam::123:user/sample@yahoo.com but that too doesn't seem to be correct as it fails with Invalid principal in policy
amazon-web-services amazon-s3
asked Mar 28 at 15:59
TonyTony
2,2137 gold badges19 silver badges34 bronze badges
To whom do you wish to grant access -- do you want to grant it to all users in several different AWS accounts?
– John Rotenstein
Mar 28 at 23:49
add a comment
|
Right now I have my policy defined on my S3 bucket but it seems like the principles I have defined are root and when someone under an account who isn't root isn't falling into the allow part of the policy
"Principal":
"AWS": [
"arn:aws:iam::123:root",
"arn:aws:iam::456:root",
"arn:aws:iam::789:root",
"arn:aws:iam::101:root"
]
,
I tired to specify it as
"arn:aws:iam::123:*"
but that doesn't work.
I also tried arn:aws:iam::123:user/sample@yahoo.com but that too doesn't seem to be correct as it fails with Invalid principal in policy
amazon-web-services amazon-s3
asked Mar 28 at 15:59
TonyTony
2,2137 gold badges19 silver badges34 bronze badges
Right now I have my policy defined on my S3 bucket but it seems like the principles I have defined are root and when someone under an account who isn't root isn't falling into the allow part of the policy
"Principal":
"AWS": [
"arn:aws:iam::123:root",
"arn:aws:iam::456:root",
"arn:aws:iam::789:root",
"arn:aws:iam::101:root"
]
,
I tired to specify it as
"arn:aws:iam::123:*"
but that doesn't work.
I also tried arn:aws:iam::123:user/sample@yahoo.com but that too doesn't seem to be correct as it fails with Invalid principal in policy
amazon-web-services amazon-s3
amazon-web-services amazon-s3
asked Mar 28 at 15:59
TonyTony
2,2137 gold badges19 silver badges34 bronze badges
asked Mar 28 at 15:59
TonyTony
2,2137 gold badges19 silver badges34 bronze badges
asked Mar 28 at 15:59
TonyTony
2,2137 gold badges19 silver badges34 bronze badges
asked Mar 28 at 15:59
TonyTony
2,2137 gold badges19 silver badges34 bronze badges
asked Mar 28 at 15:59
TonyTony
2,2137 gold badges19 silver badges34 bronze badges
2,2137 gold badges19 silver badges34 bronze badges
To whom do you wish to grant access -- do you want to grant it to all users in several different AWS accounts?
– John Rotenstein
Mar 28 at 23:49
add a comment
|
To whom do you wish to grant access -- do you want to grant it to all users in several different AWS accounts?
– John Rotenstein
Mar 28 at 23:49
To whom do you wish to grant access -- do you want to grant it to all users in several different AWS accounts?
– John Rotenstein
Mar 28 at 23:49
To whom do you wish to grant access -- do you want to grant it to all users in several different AWS accounts?
– John Rotenstein
Mar 28 at 23:49
add a comment
|
1 Answer
1
active
oldest
votes
When granting cross-account permissions, you need both of:
- A bucket policy on
Bucket-AinAccount-A(as above) - Permissions on the users in their own account to access
Bucket-A(which can include wide permissions such ass3:*, but that's rarely a good idea)
Not only does the bucket need to permit access, but the users in the originating account must be granted permission to use S3 for the desired actions (eg s3:GetObject) on Bucket-A (or all buckets).
See: Bucket Owner Granting Cross-Account Bucket Permissions - Amazon Simple Storage Service
answered Mar 28 at 23:51
John RotensteinJohn Rotenstein
97.1k8 gold badges112 silver badges165 bronze badges
add a comment
|
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55402032%2faws-s3-bucket-policy-principle-syntax%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
When granting cross-account permissions, you need both of:
- A bucket policy on
Bucket-AinAccount-A(as above) - Permissions on the users in their own account to access
Bucket-A(which can include wide permissions such ass3:*, but that's rarely a good idea)
Not only does the bucket need to permit access, but the users in the originating account must be granted permission to use S3 for the desired actions (eg s3:GetObject) on Bucket-A (or all buckets).
See: Bucket Owner Granting Cross-Account Bucket Permissions - Amazon Simple Storage Service
answered Mar 28 at 23:51
John RotensteinJohn Rotenstein
97.1k8 gold badges112 silver badges165 bronze badges
add a comment
|
When granting cross-account permissions, you need both of:
- A bucket policy on
Bucket-AinAccount-A(as above) - Permissions on the users in their own account to access
Bucket-A(which can include wide permissions such ass3:*, but that's rarely a good idea)
Not only does the bucket need to permit access, but the users in the originating account must be granted permission to use S3 for the desired actions (eg s3:GetObject) on Bucket-A (or all buckets).
See: Bucket Owner Granting Cross-Account Bucket Permissions - Amazon Simple Storage Service
answered Mar 28 at 23:51
John RotensteinJohn Rotenstein
97.1k8 gold badges112 silver badges165 bronze badges
add a comment
|
When granting cross-account permissions, you need both of:
- A bucket policy on
Bucket-AinAccount-A(as above) - Permissions on the users in their own account to access
Bucket-A(which can include wide permissions such ass3:*, but that's rarely a good idea)
Not only does the bucket need to permit access, but the users in the originating account must be granted permission to use S3 for the desired actions (eg s3:GetObject) on Bucket-A (or all buckets).
See: Bucket Owner Granting Cross-Account Bucket Permissions - Amazon Simple Storage Service
answered Mar 28 at 23:51
John RotensteinJohn Rotenstein
97.1k8 gold badges112 silver badges165 bronze badges
When granting cross-account permissions, you need both of:
- A bucket policy on
Bucket-AinAccount-A(as above) - Permissions on the users in their own account to access
Bucket-A(which can include wide permissions such ass3:*, but that's rarely a good idea)
Not only does the bucket need to permit access, but the users in the originating account must be granted permission to use S3 for the desired actions (eg s3:GetObject) on Bucket-A (or all buckets).
See: Bucket Owner Granting Cross-Account Bucket Permissions - Amazon Simple Storage Service
answered Mar 28 at 23:51
John RotensteinJohn Rotenstein
97.1k8 gold badges112 silver badges165 bronze badges
answered Mar 28 at 23:51
John RotensteinJohn Rotenstein
97.1k8 gold badges112 silver badges165 bronze badges
answered Mar 28 at 23:51
John RotensteinJohn Rotenstein
97.1k8 gold badges112 silver badges165 bronze badges
answered Mar 28 at 23:51
John RotensteinJohn Rotenstein
97.1k8 gold badges112 silver badges165 bronze badges
97.1k8 gold badges112 silver badges165 bronze badges
add a comment
|
add a comment
|
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55402032%2faws-s3-bucket-policy-principle-syntax%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
To whom do you wish to grant access -- do you want to grant it to all users in several different AWS accounts?
– John Rotenstein
Mar 28 at 23:49