How to Set S3 Access Control: Simple Guide for Beginners

To set access control on an AWS S3 bucket or object, use Access Control Lists (ACLs) or Bucket Policies. ACLs grant basic read/write permissions, while bucket policies allow detailed control over who can access your data.

Syntax

Access control in S3 can be set using two main methods:

• ACLs (Access Control Lists): Define permissions for individual AWS accounts or predefined groups.
• Bucket Policies: JSON documents that specify detailed permissions for users, roles, or services.

ACL example parts:

• Grantee: The user or group receiving permission.
• Permission: The type of access (e.g., READ, WRITE).

Bucket policy parts:

• Effect: Allow or Deny.
• Principal: Who the policy applies to.
• Action: What actions are allowed or denied.
• Resource: Which bucket or objects the policy applies to.

json/xml

Example ACL XML snippet:
<AccessControlPolicy>
  <Owner>
    <ID>owner-id</ID>
  </Owner>
  <AccessControlList>
    <Grant>
      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
        <ID>grantee-id</ID>
      </Grantee>
      <Permission>READ</Permission>
    </Grant>
  </AccessControlList>
</AccessControlPolicy>

Example Bucket Policy JSON snippet:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:user/Alice"},
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Example

This example shows how to create a bucket policy that allows a specific AWS user to read objects from a bucket named example-bucket.

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:user/Alice"},
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Output

Policy applied successfully. User Alice can now read objects in example-bucket.

Common Pitfalls

• Using ACLs alone can be limiting and less secure compared to bucket policies.
• Forgetting to include the trailing /* in the resource ARN when granting object-level permissions.
• Setting overly permissive policies that allow public access unintentionally.
• Not specifying the correct Principal leading to denied access.

json

Wrong bucket policy example (missing /*):
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket"
    }
  ]
}

Right bucket policy example:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Quick Reference

Here is a quick summary of common S3 access control elements:

Element	Description	Example Values
ACL	Basic permission set on bucket or object	READ, WRITE, FULL_CONTROL
Bucket Policy	JSON policy for detailed permissions	Allow, Deny, Principal, Action, Resource
Grantee	User or group receiving permission	CanonicalUser, AmazonCustomerByEmail, Group
Principal	Who the policy applies to	AWS ARN, * (everyone)
Action	Allowed or denied operations	s3:GetObject, s3:PutObject
Resource	Bucket or object ARN	arn:aws:s3:::bucket-name/*

Key Takeaways

Use bucket policies for detailed and secure access control over S3 buckets and objects.

Always include /* at the end of resource ARNs to specify object-level permissions.

Avoid overly broad permissions to prevent accidental public access.

ACLs provide simple permissions but are less flexible than bucket policies.

Test your policies to ensure the intended users have the correct access.