Answers: <p>First, let's understand how roles and policies work on AWS. In order for an user to be able to access a bucket, we can allow it in 3 ways:</p>
  <ol>
  <li>Allow it using an IAM policy attached to the role the user is assuming;</li>
  <li>Allow it using a bucket policy;</li>
  <li>The group of the user has the policy attached to it or there is a policy directly attached to the user which allows access to the bucket.</li>
  </ol>
  <p>These are explicit <code>Allow</code> policies. The user will have access if there is at least on policy from above granting him/her access.</p>
  <p>What is important is that an explicit <code>Deny</code> takes precedence of an explicit <code>Allow</code>. So, if we want to deny access to a specific user, we would want to create a bucket policy with an explicit <code>Deny</code>. In order to do this, <a href="https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/" rel="nofollow noreferrer">we can use <code>NotPrincipal</code></a>.</p>
  <p>Bucket policy example:</p>
  <pre><code>{
      &quot;Id&quot;: &quot;bucketPolicy&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Action&quot;: &quot;s3:*&quot;,
              &quot;Effect&quot;: &quot;Deny&quot;,
              &quot;NotPrincipal&quot;: {
                  &quot;AWS&quot;: [
                      &quot;arn:aws:iam::1234567890:user/alloweduser&quot;
                  ]
              },
              &quot;Resource&quot;: [
                  &quot;arn:aws:s3:::examplebucket&quot;,
                  &quot;arn:aws:s3:::examplebucket/*&quot;
              ]
          }
      ],
      &quot;Version&quot;: &quot;2012-10-17&quot;
  }
  </code></pre>
  <p>Terraform code for this policy:</p>
  <pre><code>data &quot;aws_iam_policy_document&quot; &quot;vulnerability-scans&quot; {
    statement {
      not_principals {
        type = &quot;AWS&quot;
        identifiers = [
          aws_iam_user.circleci.arn
        ]
      }
  
      effect = &quot;Deny&quot;
  
      actions = [
        &quot;s3:*&quot;
      ]
  
      resources = [
        aws_s3_bucket.vulnerability-scans.arn,
        &quot;${aws_s3_bucket.vulnerability-scans.arn}/*&quot;,
      ]
    }
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2022-04-12T20:44:30.370Z
Answers: restrict as in only allow for that user. not deny it.
Answers: xerxes
Answers: CC BY-SA 4.0
Answers: 2022-04-10T08:23:41.077Z
Answers: 2022-04-10T08:23:41.077Z
Answers: Ervin Szilagyi
Body: <p>I have a bucket which I need to restrict to a specific user, I have written the following script but it still seems to allow all users to operate on the bucket.</p>
  <pre><code>resource &quot;aws_s3_bucket&quot; &quot;vulnerability-scans&quot; {
    bucket = &quot;vulnerability-scans&quot;
  }
  
  resource &quot;aws_s3_bucket_policy&quot; &quot;vulnerability-scans&quot; {
    bucket = aws_s3_bucket.vulnerability-scans.id
    policy = data.aws_iam_policy_document.vulnerability-scans.json
  }
  
  data &quot;aws_iam_policy_document&quot; &quot;vulnerability-scans&quot; {
    statement {
      principals {
        type = &quot;AWS&quot;
        identifiers = [
          aws_iam_user.circleci.arn,
        ]
      }
  
      actions = [
        &quot;s3:PutObject&quot;,
        &quot;s3:GetObject&quot;,
        &quot;s3:ListBucket&quot;,
      ]
  
      resources = [
        aws_s3_bucket.vulnerability-scans.arn,
        &quot;${aws_s3_bucket.vulnerability-scans.arn}/*&quot;,
      ]
    }
  }
  </code></pre>
  
Tags: <amazon-web-services><terraform><amazon-s3>
Title: Terraform Aws S3 - deny all users except for a specific user
UserDisplayName: xerxes
ThreadText: # Terraform Aws S3 - deny all users except for a specific user
  
  (Asked by: username_0 on 2022-04-07)
  
  I have a bucket which I need to restrict to a specific user, I have written the following script but it still seems to allow all users to operate on the bucket.
  
  ```
  resource "aws_s3_bucket" "vulnerability-scans" {
    bucket = "vulnerability-scans"
  }
  
  resource "aws_s3_bucket_policy" "vulnerability-scans" {
    bucket = aws_s3_bucket.vulnerability-scans.id
    policy = data.aws_iam_policy_document.vulnerability-scans.json
  }
  
  data "aws_iam_policy_document" "vulnerability-scans" {
    statement {
      principals {
        type = "AWS"
        identifiers = [
          aws_iam_user.circleci.arn,
        ]
      }
  
      actions = [
        "s3:PutObject",
        "s3:GetObject",
        "s3:ListBucket",
      ]
  
      resources = [
        aws_s3_bucket.vulnerability-scans.arn,
        "${aws_s3_bucket.vulnerability-scans.arn}/*",
      ]
    }
  }
  
  ```
  
  **Tags:** amazon-web-services, terraform, amazon-s3
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2022-04-10. Score: 2
  
  First, let's understand how roles and policies work on AWS. In order for an user to be able to access a bucket, we can allow it in 3 ways:
  
  1. Allow it using an IAM policy attached to the role the user is assuming;
  2. Allow it using a bucket policy;
  3. The group of the user has the policy attached to it or there is a policy directly attached to the user which allows access to the bucket.
  
  These are explicit `Allow` policies. The user will have access if there is at least on policy from above granting him/her access.
  
  What is important is that an explicit `Deny` takes precedence of an explicit `Allow`. So, if we want to deny access to a specific user, we would want to create a bucket policy with an explicit `Deny`. In order to do this, [we can use `NotPrincipal`](https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/).
  
  Bucket policy example:
  
  ```
  {
      "Id": "bucketPolicy",
      "Statement": [
          {
              "Action": "s3:*",
              "Effect": "Deny",
              "NotPrincipal": {
                  "AWS": [
                      "arn:aws:iam::1234567890:user/alloweduser"
                  ]
              },
              "Resource": [
                  "arn:aws:s3:::examplebucket",
                  "arn:aws:s3:::examplebucket/*"
              ]
          }
      ],
      "Version": "2012-10-17"
  }
  
  ```
  
  Terraform code for this policy:
  
  ```
  data "aws_iam_policy_document" "vulnerability-scans" {
    statement {
      not_principals {
        type = "AWS"
        identifiers = [
          aws_iam_user.circleci.arn
        ]
      }
  
      effect = "Deny"
  
      actions = [
        "s3:*"
      ]
  
      resources = [
        aws_s3_bucket.vulnerability-scans.arn,
        "${aws_s3_bucket.vulnerability-scans.arn}/*",
      ]
    }
  }
  
  ```
  
  > **Comments:**
  > **username_0**: restrict as in only allow for that user. not deny it.  
  
  ---
  
  