<p>Attach below policy to that user:</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                        "s3:GetBucketLocation",
                        "s3:ListAllMyBuckets"
                      ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::YOUR-BUCKET",
                "arn:aws:s3:::YOUR-BUCKET/*"
            ]
        }
    ]
}
</code></pre>

<p><a href="https://www.serverkaka.com/2018/05/grant-access-to-only-one-s3-bucket-to-aws-user.html" rel="nofollow noreferrer">https://www.serverkaka.com/2018/05/grant-access-to-only-one-s3-bucket-to-aws-user.html</a></p>

CC BY-SA 4.0
2018-12-31T19:26:38.363Z
2018-12-31T19:26:38.363Z
Subhash
<p>To provide access for specific bucket, you can define the following policy for that user or group:</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionAcl"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        }
    ]
}
</code></pre>

<p><sup>Where <code>my-bucket</code> is your name of your bucket.</sup></p>

<p>Then send them the Console URL for that bucket, e.g.</p>

<ul>
<li><code>https://s3.console.aws.amazon.com/s3/buckets/BUCKET_NAME/</code></li>
</ul>

<p>Related:</p>

<ul>
<li><a href="https://stackoverflow.com/q/6615168/55075">Is there an S3 policy for limiting access to only see/access one bucket?</a></li>
</ul>

CC BY-SA 3.0
2017-10-03T11:53:06.443Z
May worth noting your actual policy block actions on the bucket itself and allow control only to inner objects of the bucket.
Tensibai
CC BY-SA 3.0
2017-10-03T11:43:32.087Z
2017-10-03T11:43:32.087Z
kenorb
<p>Add the following policy if you want to access from FTP software like <strong>WinSCP</strong>, <strong>CyberDuck</strong>, etc.</p>

<pre><code>{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": [
            "arn:aws:s3:::test1",
            "arn:aws:s3:::test2"
        ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": [
            "arn:aws:s3:::test1/*",
            "arn:aws:s3:::test2/*"
        ]
    }
  ]
}
</code></pre>

<p>I learnt from <a href="https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/" rel="nofollow noreferrer">Writing IAM Policies: How to Grant Access to an Amazon S3 Bucket</a></p>

CC BY-SA 4.0
2020-04-06T06:22:46.017Z
2020-04-06T06:22:46.017Z
shintaroid
<p>Since you are looking for programmatic role creation you might consider <a href="http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html" rel="nofollow noreferrer">IAM Roles for EC2</a>. Those can be applied to EC2 instances without human intervention, and they also avoid the need to store many credentials/keys, which is always nice when using automation.</p>

CC BY-SA 3.0
2017-08-02T07:10:45.657Z
2017-08-02T07:10:45.657Z
thinkmassive
<p>Amazon's IAM roles generally grant a role access to a particular ARN (Amazon Resource Name). Amazon notes <a href="http://docs.aws.amazon.com/AmazonS3/latest/dev/s3-arn-format.html" rel="noreferrer">on their pages</a> that for S3 a resource</p>

<blockquote>
  <p>...can be a bucket-name or a bucket-name/object-key.</p>
</blockquote>

<p><a href="https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/" rel="noreferrer">They also provide a helpful example for doing just this</a> which appears as follows:</p>

<pre><code>{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::test"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": ["arn:aws:s3:::test/*"]
    }
  ]
}
</code></pre>

CC BY-SA 3.0
2017-07-31T18:10:56.163Z
2017-07-31T18:10:56.163Z
James Shewey
<p>I have a list of buckets in AWS S3. I have created an IAM user. I have an option to provide S3 full or read only access for a user using groups. Is there any options to provide access only to a particular bucket?</p>

CC BY-SA 3.0
2017-07-30T18:27:10.657Z
Not sure about that. But, the other way round can definitely happen. I mean, a bucket accepting requests from only a particular user. Wouldn't that work for you?
Dawny33
CC BY-SA 3.0
2017-07-31T05:00:22.830Z
@Dawny33 I that case I need to create an IAM user with user name and password. Then I have to provide s3 bucket access for that user. Then that user has to create a key for accessing. Instead, I need to create a programmatic access user (which creates access keys for the user instead of username and password). I'm not able to provide permissions for such an IAM user.
Sathishkumar Jayaraj
CC BY-SA 3.0
2017-09-29T13:36:35.480Z
Related: [Restrict List of Buckets for a Specific User](https://stackoverflow.com/q/17736048/55075).
kenorb
<amazon-web-services><amazon-s3><aws-iam>
How to provide a user to access only a particular bucket in AWS S3?
Sathishkumar Jayaraj
# How to provide a user to access only a particular bucket in AWS S3?

(Asked by: username_0 on 2017-07-30)

I have a list of buckets in AWS S3. I have created an IAM user. I have an option to provide S3 full or read only access for a user using groups. Is there any options to provide access only to a particular bucket?

**Tags:** amazon-web-services, amazon-s3, aws-iam

> **Comments:**
> **username_1**: Not sure about that. But, the other way round can definitely happen. I mean, a bucket accepting requests from only a particular user. Wouldn't that work for you?  
> **username_0**: @username_1 I that case I need to create an IAM user with user name and password. Then I have to provide s3 bucket access for that user. Then that user has to create a key for accessing. Instead, I need to create a programmatic access user (which creates access keys for the user instead of username and password). I'm not able to provide permissions for such an IAM user.  
> **username_2**: Related: [Restrict List of Buckets for a Specific User](https://stackoverflow.com/q/17736048/55075).  

---

## 5 answers

### Answer by username_7 on 2017-07-31. Score: 10 | Accepted answer

Amazon's IAM roles generally grant a role access to a particular ARN (Amazon Resource Name). Amazon notes on their pages that for S3 a resource

...can be a bucket-name or a bucket-name/object-key.

They also provide a helpful example for doing just this which appears as follows:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::test"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": ["arn:aws:s3:::test/*"]
    }
  ]
}


---

### Answer by username_3 on 2018-12-31. Score: 2

Attach below policy to that user:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                        "s3:GetBucketLocation",
                        "s3:ListAllMyBuckets"
                      ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::YOUR-BUCKET",
                "arn:aws:s3:::YOUR-BUCKET/*"
            ]
        }
    ]
}

https://www.serverkaka.com/2018/05/grant-access-to-only-one-s3-bucket-to-aws-user.html


---

### Answer by username_2 on 2017-10-03. Score: 1

To provide access for specific bucket, you can define the following policy for that user or group:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionAcl"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        }
    ]
}

Where my-bucket is your name of your bucket.
Then send them the Console URL for that bucket, e.g.

https://s3.console.aws.amazon.com/s3/buckets/BUCKET_NAME/

Related:

Is there an S3 policy for limiting access to only see/access one bucket?

> **Comments:**
> **username_4**: May worth noting your actual policy block actions on the bucket itself and allow control only to inner objects of the bucket.  

---

### Answer by username_5 on 2020-04-06. Score: 0

Add the following policy if you want to access from FTP software like WinSCP, CyberDuck, etc.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": [
            "arn:aws:s3:::test1",
            "arn:aws:s3:::test2"
        ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": [
            "arn:aws:s3:::test1/*",
            "arn:aws:s3:::test2/*"
        ]
    }
  ]
}

I learnt from Writing IAM Policies: How to Grant Access to an Amazon S3 Bucket


---

### Answer by username_6 on 2017-08-02. Score: 0

Since you are looking for programmatic role creation you might consider [IAM Roles for EC2](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html). Those can be applied to EC2 instances without human intervention, and they also avoid the need to store many credentials/keys, which is always nice when using automation.


---

