<p>First, let's understand how roles and policies work on AWS. In order for an user to be able to access a bucket, we can allow it in 3 ways:</p>
<ol>
<li>Allow it using an IAM policy attached to the role the user is assuming;</li>
<li>Allow it using a bucket policy;</li>
<li>The group of the user has the policy attached to it or there is a policy directly attached to the user which allows access to the bucket.</li>
</ol>
<p>These are explicit <code>Allow</code> policies. The user will have access if there is at least on policy from above granting him/her access.</p>
<p>What is important is that an explicit <code>Deny</code> takes precedence of an explicit <code>Allow</code>. So, if we want to deny access to a specific user, we would want to create a bucket policy with an explicit <code>Deny</code>. In order to do this, <a href="https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/" rel="nofollow noreferrer">we can use <code>NotPrincipal</code></a>.</p>
<p>Bucket policy example:</p>
<pre><code>{
    &quot;Id&quot;: &quot;bucketPolicy&quot;,
    &quot;Statement&quot;: [
        {
            &quot;Action&quot;: &quot;s3:*&quot;,
            &quot;Effect&quot;: &quot;Deny&quot;,
            &quot;NotPrincipal&quot;: {
                &quot;AWS&quot;: [
                    &quot;arn:aws:iam::1234567890:user/alloweduser&quot;
                ]
            },
            &quot;Resource&quot;: [
                &quot;arn:aws:s3:::examplebucket&quot;,
                &quot;arn:aws:s3:::examplebucket/*&quot;
            ]
        }
    ],
    &quot;Version&quot;: &quot;2012-10-17&quot;
}
</code></pre>
<p>Terraform code for this policy:</p>
<pre><code>data &quot;aws_iam_policy_document&quot; &quot;vulnerability-scans&quot; {
  statement {
    not_principals {
      type = &quot;AWS&quot;
      identifiers = [
        aws_iam_user.circleci.arn
      ]
    }

    effect = &quot;Deny&quot;

    actions = [
      &quot;s3:*&quot;
    ]

    resources = [
      aws_s3_bucket.vulnerability-scans.arn,
      &quot;${aws_s3_bucket.vulnerability-scans.arn}/*&quot;,
    ]
  }
}
</code></pre>

CC BY-SA 4.0
2022-04-12T20:44:30.370Z
restrict as in only allow for that user. not deny it.
xerxes
CC BY-SA 4.0
2022-04-10T08:23:41.077Z
2022-04-10T08:23:41.077Z
Ervin Szilagyi
<p>I have a bucket which I need to restrict to a specific user, I have written the following script but it still seems to allow all users to operate on the bucket.</p>
<pre><code>resource &quot;aws_s3_bucket&quot; &quot;vulnerability-scans&quot; {
  bucket = &quot;vulnerability-scans&quot;
}

resource &quot;aws_s3_bucket_policy&quot; &quot;vulnerability-scans&quot; {
  bucket = aws_s3_bucket.vulnerability-scans.id
  policy = data.aws_iam_policy_document.vulnerability-scans.json
}

data &quot;aws_iam_policy_document&quot; &quot;vulnerability-scans&quot; {
  statement {
    principals {
      type = &quot;AWS&quot;
      identifiers = [
        aws_iam_user.circleci.arn,
      ]
    }

    actions = [
      &quot;s3:PutObject&quot;,
      &quot;s3:GetObject&quot;,
      &quot;s3:ListBucket&quot;,
    ]

    resources = [
      aws_s3_bucket.vulnerability-scans.arn,
      &quot;${aws_s3_bucket.vulnerability-scans.arn}/*&quot;,
    ]
  }
}
</code></pre>

<amazon-web-services><terraform><amazon-s3>
Terraform Aws S3 - deny all users except for a specific user
xerxes
# Terraform Aws S3 - deny all users except for a specific user

(Asked by: username_0 on 2022-04-07)

I have a bucket which I need to restrict to a specific user, I have written the following script but it still seems to allow all users to operate on the bucket.
resource "aws_s3_bucket" "vulnerability-scans" {
  bucket = "vulnerability-scans"
}

resource "aws_s3_bucket_policy" "vulnerability-scans" {
  bucket = aws_s3_bucket.vulnerability-scans.id
  policy = data.aws_iam_policy_document.vulnerability-scans.json
}

data "aws_iam_policy_document" "vulnerability-scans" {
  statement {
    principals {
      type = "AWS"
      identifiers = [
        aws_iam_user.circleci.arn,
      ]
    }

    actions = [
      "s3:PutObject",
      "s3:GetObject",
      "s3:ListBucket",
    ]

    resources = [
      aws_s3_bucket.vulnerability-scans.arn,
      "${aws_s3_bucket.vulnerability-scans.arn}/*",
    ]
  }
}

**Tags:** amazon-web-services, terraform, amazon-s3


---

## 1 answers

### Answer by username_1 on 2022-04-10. Score: 2

First, let's understand how roles and policies work on AWS. In order for an user to be able to access a bucket, we can allow it in 3 ways:

Allow it using an IAM policy attached to the role the user is assuming;
Allow it using a bucket policy;
The group of the user has the policy attached to it or there is a policy directly attached to the user which allows access to the bucket.

These are explicit Allow policies. The user will have access if there is at least on policy from above granting him/her access.
What is important is that an explicit Deny takes precedence of an explicit Allow. So, if we want to deny access to a specific user, we would want to create a bucket policy with an explicit Deny. In order to do this, we can use NotPrincipal.
Bucket policy example:
{
    "Id": "bucketPolicy",
    "Statement": [
        {
            "Action": "s3:*",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn:aws:iam::1234567890:user/alloweduser"
                ]
            },
            "Resource": [
                "arn:aws:s3:::examplebucket",
                "arn:aws:s3:::examplebucket/*"
            ]
        }
    ],
    "Version": "2012-10-17"
}

Terraform code for this policy:
data "aws_iam_policy_document" "vulnerability-scans" {
  statement {
    not_principals {
      type = "AWS"
      identifiers = [
        aws_iam_user.circleci.arn
      ]
    }

    effect = "Deny"

    actions = [
      "s3:*"
    ]

    resources = [
      aws_s3_bucket.vulnerability-scans.arn,
      "${aws_s3_bucket.vulnerability-scans.arn}/*",
    ]
  }
}

> **Comments:**
> **username_0**: restrict as in only allow for that user. not deny it.  

---

