<p>Before giving the answer I'd like to clarify that S3 is meant for <em>object</em> storage, meaning that there's no file system involved and thus there are not "directories" per se.</p>

<p>So, an "object" with the name "/avatars/user-123/xyz" might give you the impression that it's stored in the "/avatars/user-123" directory, but there's no directory involved, that's just a name.</p>

<p>That being said, you can treat that portion of the name (/avatars/user-123) as a prefix, and then you can create IAM policies for your S3 buckets using said prefixes.</p>

<p>For futre reference, the following examples have been taken from:
<a href="https://aws.amazon.com/premiumsupport/knowledge-center/s3-folder-user-access/" rel="nofollow noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/s3-folder-user-access/</a></p>

<p>In case readers find out that link has been taken down I'll just copy and paste the examples here</p>

<p>AllowStatement1 allows the user to list the buckets that belong to their AWS account. The user needs this permission to be able to navigate to the bucket using the console.</p>

<p>AllowStatement2A allows the user to list the folders within awsexamplebucket, which the user needs to be able to navigate to the folder using the console. The statement also allows the user to search on the prefix media/ using the console.</p>

<p>AllowStatement3 allows the user to list the contents within awsexamplebucket/media.</p>

<p>AllowStatement4A allows the user to download objects (s3:GetObject) from the folder awsexamplebucket/media.</p>

<pre><code>{
 "Version":"2012-10-17",
 "Statement": [
   {
     "Sid": "AllowStatement1",
     "Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::*"]
   },
  {
     "Sid": "AllowStatement2A",
     "Action": ["s3:ListBucket"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::awsexamplebucket"],
     "Condition":{"StringEquals":{"s3:prefix":["","media"]}}
    },
  {
     "Sid": "AllowStatement3",
     "Action": ["s3:ListBucket"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::awsexamplebucket"],
     "Condition":{"StringLike":{"s3:prefix":["media/*"]}}
    },    
   {
     "Sid": "AllowStatement4A",
     "Effect": "Allow",
     "Action": ["s3:GetObject"],
     "Resource": ["arn:aws:s3:::awsexamplebucket/media/*"]
   }
 ]
}



</code></pre>

CC BY-SA 4.0
2020-04-09T17:50:58.610Z
As a side note, it's best practice to apply AWS IAM Policies to Roles or Groups, not directly to Users.  You would then add the user(s) to the Group, or allow them to AssumeRole on the Role.
ashtonium
CC BY-SA 4.0
2020-04-09T16:07:22.087Z
2020-04-09T16:07:22.087Z
Guillermo Mansilla
<p>On Google Cloud Storage or Amazon S3, is there a way to give users a key to only a specific subdirectory of a storage bucket, for example:</p>

<pre><code>gs://images.eng.cm.com/avatars/&lt;user-uuid&gt;/xyz
</code></pre>

<p>so the user has a user id of  and they can read and write only to that subdirectory of the storage bucket, and only if they have a read/write access key in hand too?</p>

<p>Anyone know how to create this fine-grained access control? is it possible/advised?</p>

<amazon-s3><images><google-cloud-storage>
How to make different permissions for different subdirectories of storage bucket
Alexander Mills
# How to make different permissions for different subdirectories of storage bucket

(Asked by: username_0 on 2020-04-08)

On Google Cloud Storage or Amazon S3, is there a way to give users a key to only a specific subdirectory of a storage bucket, for example:
gs://images.eng.cm.com/avatars//xyz

so the user has a user id of  and they can read and write only to that subdirectory of the storage bucket, and only if they have a read/write access key in hand too?
Anyone know how to create this fine-grained access control? is it possible/advised?

**Tags:** amazon-s3, images, google-cloud-storage


---

## 1 answers

### Answer by username_1 on 2020-04-09. Score: 2

Before giving the answer I'd like to clarify that S3 is meant for object storage, meaning that there's no file system involved and thus there are not "directories" per se.
So, an "object" with the name "/avatars/user-123/xyz" might give you the impression that it's stored in the "/avatars/user-123" directory, but there's no directory involved, that's just a name.
That being said, you can treat that portion of the name (/avatars/user-123) as a prefix, and then you can create IAM policies for your S3 buckets using said prefixes.
For futre reference, the following examples have been taken from:
https://aws.amazon.com/premiumsupport/knowledge-center/s3-folder-user-access/
In case readers find out that link has been taken down I'll just copy and paste the examples here
AllowStatement1 allows the user to list the buckets that belong to their AWS account. The user needs this permission to be able to navigate to the bucket using the console.
AllowStatement2A allows the user to list the folders within awsexamplebucket, which the user needs to be able to navigate to the folder using the console. The statement also allows the user to search on the prefix media/ using the console.
AllowStatement3 allows the user to list the contents within awsexamplebucket/media.
AllowStatement4A allows the user to download objects (s3:GetObject) from the folder awsexamplebucket/media.
{
 "Version":"2012-10-17",
 "Statement": [
   {
     "Sid": "AllowStatement1",
     "Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::*"]
   },
  {
     "Sid": "AllowStatement2A",
     "Action": ["s3:ListBucket"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::awsexamplebucket"],
     "Condition":{"StringEquals":{"s3:prefix":["","media"]}}
    },
  {
     "Sid": "AllowStatement3",
     "Action": ["s3:ListBucket"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::awsexamplebucket"],
     "Condition":{"StringLike":{"s3:prefix":["media/*"]}}
    },    
   {
     "Sid": "AllowStatement4A",
     "Effect": "Allow",
     "Action": ["s3:GetObject"],
     "Resource": ["arn:aws:s3:::awsexamplebucket/media/*"]
   }
 ]
}

> **Comments:**
> **username_2**: As a side note, it's best practice to apply AWS IAM Policies to Roles or Groups, not directly to Users.  You would then add the user(s) to the Group, or allow them to AssumeRole on the Role.  

---

