Configuring Bucket Policies

S3 access management features enable flexible configuration of access rules for various use cases. Below are some useful examples of S3 bucket policy configurations.

Restricting Access to HTTPS Only

To secure data transmission, you can restrict bucket access to HTTPS connections only. This prevents access attempts using unsecured HTTP requests, reducing the risk of data compromise.

1. Create a policy file named ssl.json:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::<bucket_name>/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}

2. Apply the policy using the following command:

aws s3api put-bucket-policy --bucket <bucket_name> --policy file://ssl.json --endpoint-url https://s3.hostman.com

Now, any HTTP requests will return a 403 error.

Restricting Access by IP Addresses

To enhance security, you can limit bucket access to specific IP addresses. This is useful for protecting data from unauthorized external access.

1. Create a policy file named ip.json:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::<bucket_name>/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": [
                        "<IP_address>"
                    ]
                }
            }
        }
    ]
}

2. Apply the policy using the following command:

aws s3api put-bucket-policy --bucket <bucket_name> --policy file://ip.json --endpoint-url https://s3.hostman.com

Granting Access to a Specific Prefix

If you need to provide access to specific objects in a bucket, such as files under a certain prefix, use the following policy. This is ideal for private buckets to allow access only to specific data.

1. Create a policy file named prefix.json:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<bucket_name>/html/*"
        }
    ]
}

2. Apply the policy using the following command:

aws s3api put-bucket-policy --bucket <bucket_name> --policy file://prefix.json --endpoint-url https://s3.hostman.com

Now, all files under the /html prefix will be accessible for reading.