Answers: <p>Attach below policy to that user:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                          "s3:GetBucketLocation",
                          "s3:ListAllMyBuckets"
                        ],
              "Resource": "arn:aws:s3:::*"
          },
          {
              "Effect": "Allow",
              "Action": "s3:*",
              "Resource": [
                  "arn:aws:s3:::YOUR-BUCKET",
                  "arn:aws:s3:::YOUR-BUCKET/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p><a href="https://www.serverkaka.com/2018/05/grant-access-to-only-one-s3-bucket-to-aws-user.html" rel="nofollow noreferrer">https://www.serverkaka.com/2018/05/grant-access-to-only-one-s3-bucket-to-aws-user.html</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2018-12-31T19:26:38.363Z
Answers: 2018-12-31T19:26:38.363Z
Answers: Subhash
Answers: <p>To provide access for specific bucket, you can define the following policy for that user or group:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket",
                  "s3:GetBucketLocation",
                  "s3:ListBucketMultipartUploads"
              ],
              "Resource": [
                  "arn:aws:s3:::my-bucket"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "s3:AbortMultipartUpload",
                  "s3:DeleteObject",
                  "s3:DeleteObjectVersion",
                  "s3:GetObject",
                  "s3:GetObjectAcl",
                  "s3:GetObjectVersion",
                  "s3:GetObjectVersionAcl",
                  "s3:PutObject",
                  "s3:PutObjectAcl",
                  "s3:PutObjectVersionAcl"
              ],
              "Resource": [
                  "arn:aws:s3:::my-bucket/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListAllMyBuckets"
              ],
              "Resource": "arn:aws:s3:::*"
          }
      ]
  }
  </code></pre>
  
  <p><sup>Where <code>my-bucket</code> is your name of your bucket.</sup></p>
  
  <p>Then send them the Console URL for that bucket, e.g.</p>
  
  <ul>
  <li><code>https://s3.console.aws.amazon.com/s3/buckets/BUCKET_NAME/</code></li>
  </ul>
  
  <p>Related:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/q/6615168/55075">Is there an S3 policy for limiting access to only see/access one bucket?</a></li>
  </ul>
  
Answers: CC BY-SA 3.0
Answers: 2017-10-03T11:53:06.443Z
Answers: May worth noting your actual policy block actions on the bucket itself and allow control only to inner objects of the bucket.
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-10-03T11:43:32.087Z
Answers: 2017-10-03T11:43:32.087Z
Answers: kenorb
Answers: <p>Add the following policy if you want to access from FTP software like <strong>WinSCP</strong>, <strong>CyberDuck</strong>, etc.</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "s3:GetBucketLocation",
          "s3:ListAllMyBuckets"
        ],
        "Resource": "*"
      },
      {
        "Effect": "Allow",
        "Action": ["s3:ListBucket"],
        "Resource": [
              "arn:aws:s3:::test1",
              "arn:aws:s3:::test2"
          ]
      },
      {
        "Effect": "Allow",
        "Action": [
          "s3:PutObject",
          "s3:GetObject",
          "s3:DeleteObject"
        ],
        "Resource": [
              "arn:aws:s3:::test1/*",
              "arn:aws:s3:::test2/*"
          ]
      }
    ]
  }
  </code></pre>
  
  <p>I learnt from <a href="https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/" rel="nofollow noreferrer">Writing IAM Policies: How to Grant Access to an Amazon S3 Bucket</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2020-04-06T06:22:46.017Z
Answers: 2020-04-06T06:22:46.017Z
Answers: shintaroid
Answers: <p>Since you are looking for programmatic role creation you might consider <a href="http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html" rel="nofollow noreferrer">IAM Roles for EC2</a>. Those can be applied to EC2 instances without human intervention, and they also avoid the need to store many credentials/keys, which is always nice when using automation.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-08-02T07:10:45.657Z
Answers: 2017-08-02T07:10:45.657Z
Answers: thinkmassive
Answers: <p>Amazon's IAM roles generally grant a role access to a particular ARN (Amazon Resource Name). Amazon notes <a href="http://docs.aws.amazon.com/AmazonS3/latest/dev/s3-arn-format.html" rel="noreferrer">on their pages</a> that for S3 a resource</p>
  
  <blockquote>
    <p>...can be a bucket-name or a bucket-name/object-key.</p>
  </blockquote>
  
  <p><a href="https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/" rel="noreferrer">They also provide a helpful example for doing just this</a> which appears as follows:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": ["s3:ListBucket"],
        "Resource": ["arn:aws:s3:::test"]
      },
      {
        "Effect": "Allow",
        "Action": [
          "s3:PutObject",
          "s3:GetObject",
          "s3:DeleteObject"
        ],
        "Resource": ["arn:aws:s3:::test/*"]
      }
    ]
  }
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2017-07-31T18:10:56.163Z
Answers: 2017-07-31T18:10:56.163Z
Answers: James Shewey
Body: <p>I have a list of buckets in AWS S3. I have created an IAM user. I have an option to provide S3 full or read only access for a user using groups. Is there any options to provide access only to a particular bucket?</p>
  
Comments: CC BY-SA 3.0
Comments: 2017-07-30T18:27:10.657Z
Comments: Not sure about that. But, the other way round can definitely happen. I mean, a bucket accepting requests from only a particular user. Wouldn't that work for you?
Comments: Dawny33
Comments: CC BY-SA 3.0
Comments: 2017-07-31T05:00:22.830Z
Comments: @Dawny33 I that case I need to create an IAM user with user name and password. Then I have to provide s3 bucket access for that user. Then that user has to create a key for accessing. Instead, I need to create a programmatic access user (which creates access keys for the user instead of username and password). I'm not able to provide permissions for such an IAM user.
Comments: Sathishkumar Jayaraj
Comments: CC BY-SA 3.0
Comments: 2017-09-29T13:36:35.480Z
Comments: Related: [Restrict List of Buckets for a Specific User](https://stackoverflow.com/q/17736048/55075).
Comments: kenorb
Tags: <amazon-web-services><amazon-s3><aws-iam>
Title: How to provide a user to access only a particular bucket in AWS S3?
UserDisplayName: Sathishkumar Jayaraj
ThreadText: # How to provide a user to access only a particular bucket in AWS S3?
  
  (Asked by: username_0 on 2017-07-30)
  
  I have a list of buckets in AWS S3. I have created an IAM user. I have an option to provide S3 full or read only access for a user using groups. Is there any options to provide access only to a particular bucket?
  
  **Tags:** amazon-web-services, amazon-s3, aws-iam
  
  > **Comments:**
  > **username_1**: Not sure about that. But, the other way round can definitely happen. I mean, a bucket accepting requests from only a particular user. Wouldn't that work for you?  
  > **username_0**: @username_1 I that case I need to create an IAM user with user name and password. Then I have to provide s3 bucket access for that user. Then that user has to create a key for accessing. Instead, I need to create a programmatic access user (which creates access keys for the user instead of username and password). I'm not able to provide permissions for such an IAM user.  
  > **username_2**: Related: [Restrict List of Buckets for a Specific User](https://stackoverflow.com/q/17736048/55075).  
  
  ---
  
  ## 5 answers
  
  ### Answer by username_7 on 2017-07-31. Score: 10 | Accepted answer
  
  Amazon's IAM roles generally grant a role access to a particular ARN (Amazon Resource Name). Amazon notes [on their pages](http://docs.aws.amazon.com/AmazonS3/latest/dev/s3-arn-format.html) that for S3 a resource
  
  > ...can be a bucket-name or a bucket-name/object-key.
  
  [They also provide a helpful example for doing just this](https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/) which appears as follows:
  
  ```
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": ["s3:ListBucket"],
        "Resource": ["arn:aws:s3:::test"]
      },
      {
        "Effect": "Allow",
        "Action": [
          "s3:PutObject",
          "s3:GetObject",
          "s3:DeleteObject"
        ],
        "Resource": ["arn:aws:s3:::test/*"]
      }
    ]
  }
  
  ```
  
  
  ---
  
  ### Answer by username_3 on 2018-12-31. Score: 2
  
  Attach below policy to that user:
  
  ```
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                          "s3:GetBucketLocation",
                          "s3:ListAllMyBuckets"
                        ],
              "Resource": "arn:aws:s3:::*"
          },
          {
              "Effect": "Allow",
              "Action": "s3:*",
              "Resource": [
                  "arn:aws:s3:::YOUR-BUCKET",
                  "arn:aws:s3:::YOUR-BUCKET/*"
              ]
          }
      ]
  }
  
  ```
  
  <https://www.serverkaka.com/2018/05/grant-access-to-only-one-s3-bucket-to-aws-user.html>
  
  
  ---
  
  ### Answer by username_2 on 2017-10-03. Score: 1
  
  To provide access for specific bucket, you can define the following policy for that user or group:
  
  ```
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket",
                  "s3:GetBucketLocation",
                  "s3:ListBucketMultipartUploads"
              ],
              "Resource": [
                  "arn:aws:s3:::my-bucket"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "s3:AbortMultipartUpload",
                  "s3:DeleteObject",
                  "s3:DeleteObjectVersion",
                  "s3:GetObject",
                  "s3:GetObjectAcl",
                  "s3:GetObjectVersion",
                  "s3:GetObjectVersionAcl",
                  "s3:PutObject",
                  "s3:PutObjectAcl",
                  "s3:PutObjectVersionAcl"
              ],
              "Resource": [
                  "arn:aws:s3:::my-bucket/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListAllMyBuckets"
              ],
              "Resource": "arn:aws:s3:::*"
          }
      ]
  }
  
  ```
  
  Where `my-bucket` is your name of your bucket.
  
  Then send them the Console URL for that bucket, e.g.
  
  * `https://s3.console.aws.amazon.com/s3/buckets/BUCKET_NAME/`
  
  Related:
  
  * [Is there an S3 policy for limiting access to only see/access one bucket?](https://stackoverflow.com/q/6615168/55075)
  
  > **Comments:**
  > **username_4**: May worth noting your actual policy block actions on the bucket itself and allow control only to inner objects of the bucket.  
  
  ---
  
  ### Answer by username_5 on 2020-04-06. Score: 0
  
  Add the following policy if you want to access from FTP software like **WinSCP**, **CyberDuck**, etc.
  
  ```
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "s3:GetBucketLocation",
          "s3:ListAllMyBuckets"
        ],
        "Resource": "*"
      },
      {
        "Effect": "Allow",
        "Action": ["s3:ListBucket"],
        "Resource": [
              "arn:aws:s3:::test1",
              "arn:aws:s3:::test2"
          ]
      },
      {
        "Effect": "Allow",
        "Action": [
          "s3:PutObject",
          "s3:GetObject",
          "s3:DeleteObject"
        ],
        "Resource": [
              "arn:aws:s3:::test1/*",
              "arn:aws:s3:::test2/*"
          ]
      }
    ]
  }
  
  ```
  
  I learnt from [Writing IAM Policies: How to Grant Access to an Amazon S3 Bucket](https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/)
  
  
  ---
  
  ### Answer by username_6 on 2017-08-02. Score: 0
  
  Since you are looking for programmatic role creation you might consider [IAM Roles for EC2](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html). Those can be applied to EC2 instances without human intervention, and they also avoid the need to store many credentials/keys, which is always nice when using automation.
  
  
  ---
  
  