Bucket policies for access control in AWS - Mini Project: Build & Apply

Bucket policies for access control

📖 Scenario: You are managing a cloud storage bucket where you want to control who can access the files. You will create a bucket policy that allows only specific users to read files from the bucket.

🎯 Goal: Build an AWS S3 bucket policy that grants read-only access to a specific user and denies access to everyone else.

📋 What You'll Learn

Create a bucket policy JSON structure

Add a statement that allows read access to a specific AWS user ARN

Add a statement that denies all other users access

Use correct JSON syntax for AWS bucket policies

💡 Why This Matters

🌍 Real World

Bucket policies control who can access files in cloud storage, protecting data and managing permissions.

💼 Career

Understanding bucket policies is essential for cloud administrators and developers managing secure cloud storage.

1

Create the basic bucket policy structure

Create a variable called bucket_policy and assign it a dictionary with the key Version set to "2012-10-17" and an empty list for the key Statement.

AWS

bucket_policy = {
    "Version": "2012-10-17",
    "Statement": []
}
# Your code here

Hint

The bucket policy must start with a Version and an empty Statement list.

2

Add an allow statement for a specific user

Add a dictionary to bucket_policy["Statement"] that allows "s3:GetObject" action for the resource "arn:aws:s3:::example-bucket/*" and the principal with the AWS user ARN "arn:aws:iam::123456789012:user/Alice". Use Effect set to "Allow".

AWS

bucket_policy = {
    "Version": "2012-10-17",
    "Statement": []
}
# Add allow statement for user Alice here

Hint

The allow statement must specify the action, resource, principal, and effect.

3

Add a deny statement for all other users

Add another dictionary to bucket_policy["Statement"] that denies "s3:GetObject" action for the resource "arn:aws:s3:::example-bucket/*" to the principal "*" (everyone). Use Effect set to "Deny".

AWS

bucket_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {"AWS": "arn:aws:iam::123456789012:user/Alice"},
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::example-bucket/*"
        }
    ]
}
# Add deny statement for all other users here

Hint

The deny statement blocks everyone except the allowed user.

4

Convert the bucket policy to a JSON string

Import the json module and create a variable called bucket_policy_json that contains the JSON string of bucket_policy using json.dumps() with indentation of 2 spaces.

AWS

bucket_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {"AWS": "arn:aws:iam::123456789012:user/Alice"},
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::example-bucket/*"
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::example-bucket/*"
        }
    ]
}
# Import json and convert bucket_policy to JSON string with indent=2

Hint

Use the json module to convert the dictionary to a JSON string for AWS.

Practice

1. What is the main purpose of a bucket policy in AWS S3?

easy

A. To monitor the bucket usage statistics

B. To store files inside the bucket

C. To control who can access and perform actions on the bucket

D. To backup the bucket data automatically

Solution

1. Step 1: Understand bucket policy role

   A bucket policy defines permissions for users or services to access the bucket.

2. Step 2: Differentiate from other functions

   Storing files, monitoring, and backup are separate features, not controlled by bucket policies.

3. Final Answer:

   To control who can access and perform actions on the bucket -> Option C

4. Quick Check:

   Bucket policy = Access control [OK]

Hint: Bucket policies manage access permissions only [OK]

Common Mistakes:

• Confusing bucket policy with storage function
• Thinking bucket policy handles backups
• Assuming bucket policy monitors usage

2. Which of the following is the correct JSON key to specify who is allowed or denied access in a bucket policy?

easy

A. "Action"

B. "Principal"

C. "Resource"

D. "Effect"

Solution

1. Step 1: Identify the key for user or service

   The "Principal" key specifies the user, account, service, or entity the policy applies to.

2. Step 2: Differentiate from other keys

   "Action" defines allowed actions, "Resource" defines the bucket or objects, "Effect" states Allow or Deny.

3. Final Answer:

   "Principal" -> Option B

4. Quick Check:

   Who = Principal [OK]

Hint: Principal means who gets access [OK]

Common Mistakes:

• Confusing "Action" with "Principal"
• Using "Effect" to specify user
• Mixing up "Resource" with user identity

3. Given this bucket policy snippet, what does it allow?

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::example-bucket/*"
}

medium

A. Allows anyone to upload files to the bucket

B. Allows only the bucket owner to delete objects

C. Denies all access to the bucket

D. Allows anyone to read objects from the bucket

Solution

1. Step 1: Analyze the Effect and Principal

   Effect is "Allow" and Principal is "*" meaning everyone is allowed.

2. Step 2: Check the Action and Resource

   Action is "s3:GetObject" which means read access to objects in the bucket "example-bucket".

3. Final Answer:

   Allows anyone to read objects from the bucket -> Option D

4. Quick Check:

   Allow + * + GetObject = public read [OK]

Hint: Effect Allow + Principal * + GetObject = public read [OK]

Common Mistakes:

• Thinking GetObject allows uploads
• Confusing Allow with Deny
• Ignoring the wildcard * in Principal

4. You wrote this bucket policy but users still cannot upload files:

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::example-bucket"
}

What is the problem?

medium

A. The Resource ARN is missing the /* to specify objects

B. The Action s3:PutObject is invalid

C. The Principal cannot be * for uploads

D. Effect should be Deny to allow uploads

Solution

1. Step 1: Check the Resource ARN format

   To allow object uploads, Resource must include "/*" to specify objects inside the bucket.

2. Step 2: Validate Action and Principal

   s3:PutObject is valid, Principal "*" is allowed, and Effect "Allow" is correct.

3. Final Answer:

   The Resource ARN is missing the /* to specify objects -> Option A

4. Quick Check:

   PutObject needs resource with /* [OK]

Hint: Resource must end with /* for object actions [OK]

Common Mistakes:

• Using bucket ARN without /* for object actions
• Thinking Principal * is disallowed
• Confusing Allow and Deny effects

5. You want to create a bucket policy that denies all users except a specific AWS account (ID: 123456789012) from deleting objects in your bucket named "secure-bucket". Which policy snippet correctly enforces this?

hard

A. {
"Effect": "Deny",
"Principal": "*",
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::secure-bucket/*",
"Condition": {
"StringNotEquals": {
"aws:PrincipalAccount": "123456789012"
}
}
}

B. {
"Effect": "Allow",
"Principal": {"AWS": "arn:aws:iam::123456789012:root"},
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::secure-bucket/*"
}

C. {
"Effect": "Deny",
"Principal": {"AWS": "arn:aws:iam::123456789012:root"},
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::secure-bucket/*"
}

D. {
"Effect": "Allow",
"Principal": "*",
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::secure-bucket/*"
}

Solution

1. Step 1: Understand the requirement

   We want to deny delete actions to everyone except the specified account.

2. Step 2: Analyze each option

   { "Effect": "Deny", "Principal": "*", "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::secure-bucket/*", "Condition": { "StringNotEquals": { "aws:PrincipalAccount": "123456789012" } } } denies delete to all principals except where the principal account equals 123456789012 using Condition StringNotEquals. This matches the requirement.
   { "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::123456789012:root"}, "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::secure-bucket/*" } allows only the specified account but does not deny others explicitly.
   { "Effect": "Deny", "Principal": {"AWS": "arn:aws:iam::123456789012:root"}, "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::secure-bucket/*" } denies only the specified account, opposite of requirement.
   { "Effect": "Allow", "Principal": "*", "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::secure-bucket/*" } allows everyone, which is incorrect.

3. Final Answer:

   Option A correctly denies delete to all except the specified account -> Option A

4. Quick Check:

   Deny with Condition StringNotEquals excludes one account [OK]

Hint: Use Deny with Condition StringNotEquals for exceptions [OK]

Common Mistakes:

• Using Allow without Deny for blocking others
• Denying the allowed account by mistake
• Not specifying Condition for exceptions