--- title: "Create a least privilege S3 bucket policy [Cheat Sheet] - Cybr" description: "Learn how to create a least privilege S3 bucket policy with tips and an example scenario from AWS IAM experts" url: https://cybr.com/cloud-security/create-a-least-privilege-s3-bucket-policy/ --- # Create a least privilege S3 bucket policy \[Cheat Sheet\] Learning how to keep your Amazon S3 buckets safe and finding weak spots in bucket policies is an important part of managing AWS resources and… Christophe Published January 10, 2024 · Updated January 23, 2024 Learning how to keep your Amazon S3 buckets safe and finding weak spots in bucket policies is an important part of managing AWS resources and acing the [AWS Certified Security Specialty exam](https://cybr.com/courses/aws-certified-security-specialty-course/). Not only will it help you prevent a costly S3 data leak, but you should also anticipate exam questions that will ask you to look at IAM and bucket policies to fix issues or implement solutions following best practices. So I asked an AWS IAM expert, [Stephen Kuenzli](https://www.linkedin.com/in/ACoAAADQp54BXHK-BBoxOEF_X8LKxIXv04DOzYI) from [k9 Security](https://www.linkedin.com/company/k9-security/), to give us best practices tips & tricks, and here’s the cheat sheet we came up with: ## Scenario: You’re tasked with locking down access to a ‘sensitive-app-data’ bucket so that only these principals have access: - Administrators: admin (role), ci (user) – to administer the bucket - Application: app (role) – read & write data to/from bucket - Support: cust-service (role) – to read data Here’s how you should go about granting least privilege permissions to this bucket (in order): 1. Deny access to the bucket and its objects to everyone who is not one of the intended principals 2. Grant the administrators privileges to administer the bucket 3. Allow the application and customer support roles to read data from the bucket 4. Allow the application to write data into the bucket 5. Add any other policy enforcements, like requiring encryption in transit and at rest ## Pro tips: - Organize your statements by capabilities granted to principals so you can track who has those capabilities over time (I didn’t use to do this and my statements were an absolute mess before I heard this advice) - For you to only grant access to intended principals and resources, two things should be included in your security policies: - Identity policies attached to principals should scope resource access to implement the least privilege for the principal - Resource policies should allow intended principals and explicit deny everyone else to implement the least privilege for the resources ## Create a least privilege **S3 bucket policy** [https://k9security.io ![k9 Security](https://cybr.com/s3-least-privilege-assets/k9-logo.png)](https://k9security.io/) [Stephen Kuenzli](https://www.linkedin.com/in/stephenkuenzli) [https://cybr.com **Cybr**](https://cybr.com/) [Christophe Limpalair](https://www.linkedin.com/in/christophelimpalair/) ### Scenario: You’re tasked with locking down access to a ‘**sensitive-app-data**’ bucket so that only these principals have access: - Administrators: admin (**role**), ci (**user**) - to administer the bucket - Application: app (**role**) - read & write data to/from bucket - Support: cust-service (**role**) - to read data ![AWS](https://cybr.com/s3-least-privilege-assets/aws-cloud.svg) Account 111 Roles App Users Resource Policy sensitive-app-data Administrators, Customer Service Continuous Integration & Delivery ### Process of granting least privilege First, deny access to the bucket and its objects to everyone who is not one of the intended principals: ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyEveryoneElse", "Effect": "Deny", "Action": "s3:*", "Resource": [ "arn:aws:s3:::sensitive-app-data/*", "arn:aws:s3:::sensitive-app-data" ], "Principal": { "AWS": "*" }, "Condition": { "ArnNotEquals": { "aws:PrincipalArn": [ "arn:aws:iam::111:user/ci", "arn:aws:iam::111:role/cust-service", "arn:aws:iam::111:role/app", "arn:aws:iam::111:role/admin" ] } } }, ``` Then, grant the administrators privileges to administer the bucket: ``` { "Sid": "AllowRestrictedAdministerResource", "Effect": "Allow", "Action": [ "s3:PutBucketPolicy", "s3:PutBucketAcl" ], "Resource": [ "arn:aws:s3:::sensitive-app-data/*", "arn:aws:s3:::sensitive-app-data" ], "Principal": { "AWS": "*" }, "Condition": { "ArnEquals": { "aws:PrincipalArn": [ "arn:aws:iam::111:user/ci", "arn:aws:iam::111:role/admin" ] } }}, ``` Now, allow the application and customer support roles to read: ``` { "Sid": "AllowRestrictedReadData", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::sensitive-app-data/*", "arn:aws:s3:::sensitive-app-data" ], "Principal": { "AWS": "*" }, "Condition": { "ArnEquals": { "aws:PrincipalArn": [ "arn:aws:iam::111:role/cust-service", "arn:aws:iam::111:role/app" ] } }}, ``` Then, allow the application to write data into the bucket: ``` { "Sid": "AllowRestrictedWriteData", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::sensitive-app-data/*", "arn:aws:s3:::sensitive-app-data" ], "Principal": { "AWS": "*" }, "Condition": { "ArnEquals": { "aws:PrincipalArn": "arn:aws:iam::111:role/app" } }} ]} ``` Add other policy enforcements here such as requiring encryption in transport and at rest ### Pro Tip: Organize statements by capabilities granted to principals so you can track who has those capabilities over time. For you to only grant access to intended principals and resources, two things should be included in your security policies: 1. Identity policies attached to principals should scope resource access to implement the least privilege for the principal 2. Resource policies should allow intended principals and explicit deny everyone else to implement the least privilege for the resources ### Use this cheat sheet with AI Copy a ready-to-use prompt into your preferred AI assistant. Goal Preview prompt Prompt [Learn how to secure AWS with IAM built for continuous delivery: **https://effectiveiam.com/**](https://effectiveiam.com/) [![k9 Security](https://cybr.com/s3-least-privilege-assets/k9-logo.png) The simplest & most scalable way of managing AWS IAM permissions: **https://k9security.io**](https://k9security.io/) [ Learn AWS and IAM best practices hands-on: **https://cybr.com/labs**](https://cybr.com/hands-on-labs/) ## Learn AWS IAM best practices and get certified with Cybr’s training Already have a Cybr Membership? [Access our AWS training here](https://cybr.com/courses/). Looking to upskill or reskill your team in AWS security? [Get a demo](https://calendly.com/meeting-cybr/30min) of our hands-on training. Looking for individual training? [View our pricing here](https://cybr.com/pricing). ## Filed under - [Cloud Security](https://cybr.com/cloud-security/) - [AWS](https://cybr.com/tag/aws/) - [AWS Security](https://cybr.com/tag/aws-security/) - [AWS Security Cheat Sheets](https://cybr.com/tag/aws-security-cheat-sheets/) - [Cheat Sheets](https://cybr.com/tag/cheat-sheets/) - [Cloud Security](https://cybr.com/tag/cloud-security/) ## Comments Loading comments… Recommended resources [![Explore the AWS Certified Security Specialty course](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)](https://cybr.com/courses/aws-certified-security-specialty-course/) ## Build practical AWS security skills Start with the core services, then prepare for the AWS Certified Security Specialty exam with guided lessons and hands-on practice. [Introduction to AWS Security](https://cybr.com/courses/introduction-to-aws-security/) [Security Specialty course](https://cybr.com/courses/aws-certified-security-specialty-course/)