Question

You want to allow a specific AWS account to read objects but deny all others. Which bucket policy snippet achieves this?

Accepted Answer

{ "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::111122223333:root"}, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::mybucket/*" }

Answer

{ "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::mybucket/*" }

Answer

{ "Effect": "Deny", "Principal": {"AWS": "arn:aws:iam::111122223333:root"}, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::mybucket/*" }

Answer

{ "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::444455556666:root"}, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::mybucket/*" }

You want to allow a specific AWS account to read objects but deny all others. Which bucket policy snippet achieves this?

Want More Practice?