Create a least privilege S3 bucket policy

https://k9security.io

Stephen Kuenzli

https://cybr.com

Cybr Christophe Limpalair

Scenario:

You’re tasked with locking down access to a ‘sensitive-app-data’ bucket so that only these principals have access:

Administrators: admin (role), ci (user) - to administer the bucket
Application: app (role) - read & write data to/from bucket
Support: cust-service (role) - to read data

Account 111

Roles

App

Users

Resource Policy

sensitive-app-data

Administrators,
Customer Service

Continuous
Integration &
Delivery

Process of granting least privilege

First, deny access to the bucket and its objects to everyone who is not one of the intended principals:

{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "DenyEveryoneElse",      "Effect": "Deny",      "Action": "s3:*",      "Resource": [        "arn:aws:s3:::sensitive-app-data/*", "arn:aws:s3:::sensitive-app-data"      ],      "Principal": {        "AWS": "*"      },      "Condition": {        "ArnNotEquals": {          "aws:PrincipalArn": [            "arn:aws:iam::111:user/ci", "arn:aws:iam::111:role/cust-service",            "arn:aws:iam::111:role/app", "arn:aws:iam::111:role/admin"          ]        }      }    },

Then, grant the administrators privileges to administer the bucket:

{  "Sid": "AllowRestrictedAdministerResource",  "Effect": "Allow",  "Action": [    "s3:PutBucketPolicy",    "s3:PutBucketAcl"  ],  "Resource": [    "arn:aws:s3:::sensitive-app-data/*",    "arn:aws:s3:::sensitive-app-data"  ],  "Principal": {    "AWS": "*"  },  "Condition": {    "ArnEquals": {      "aws:PrincipalArn": [        "arn:aws:iam::111:user/ci",        "arn:aws:iam::111:role/admin"      ]    }  }},

Now, allow the application and customer support roles to read:

{  "Sid": "AllowRestrictedReadData",  "Effect": "Allow",  "Action": [    "s3:GetObject",    "s3:ListBucket"  ],  "Resource": [    "arn:aws:s3:::sensitive-app-data/*",    "arn:aws:s3:::sensitive-app-data"  ],  "Principal": {    "AWS": "*"  },  "Condition": {    "ArnEquals": {      "aws:PrincipalArn": [        "arn:aws:iam::111:role/cust-service",        "arn:aws:iam::111:role/app"      ]    }  }},

Then, allow the application to write data into the bucket:

{  "Sid": "AllowRestrictedWriteData",  "Effect": "Allow",  "Action": [    "s3:AbortMultipartUpload",    "s3:PutObject"  ],  "Resource": [    "arn:aws:s3:::sensitive-app-data/*",    "arn:aws:s3:::sensitive-app-data"  ],  "Principal": {    "AWS": "*"  },  "Condition": {    "ArnEquals": {      "aws:PrincipalArn": "arn:aws:iam::111:role/app"    }  }}  ]}

Add other policy enforcements here such as requiring encryption in transport and at rest

Pro Tip:

Organize statements by capabilities granted to principals so you can track who has those capabilities over time.

For you to only grant access to intended principals and resources, two things should be included in your security policies:

Identity policies attached to principals should scope resource access to implement the least privilege for the principal
Resource policies should allow intended principals and explicit deny everyone else to implement the least privilege for the resources

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Use this Cybr cheat sheet as reference: Create a least privilege S3 bucket policy
Source: https://cybr.com/cheat-sheets/s3-least-privilege/

My goal: Help me write a bucket policy

Help me create a least-privilege S3 bucket policy. Ask for the principals, required operations, bucket and prefixes, account relationships, and access conditions. Provide a policy with clear placeholders, explain every statement, and include positive and negative access tests. Separate bucket and object permissions and explain the interaction with identity policies.

Use the included reference material even if you cannot open the source URL. Ask for missing context rather than inventing my environment. Explain assumptions. For version-sensitive service behavior or commands, consult current official documentation when available, cite it, and explain any differences from this reference. If you cannot verify something, say so.

Reference material from the cheat sheet (structured text or a curated summary):

A least-privilege S3 bucket policy starts with the identities, operations, resources, and conditions that a workload requires. Scope principals to the intended roles, actions to required operations, and resource ARNs to the bucket or object prefixes. Bucket actions and object actions use different ARN shapes. Conditions can constrain context such as transport or network origin. Explicit denies override allows. Evaluate the bucket policy together with IAM policies and other applicable controls, and test both intended access and requests that should fail.

More cheat sheets