reports (bucket)

Try it: how do you stop unsigned requests from reading q3.pdf while Reader still can?

  • Object OwnershipPick one of three. The last two differ only in who owns objects other accounts upload; here they give the same results.
  • Block all public accessBlock Public Access · turns all four below on or off at once
    • Through new ACLsBlockPublicAclsOnce on, S3 rejects any attempt to write a public ACL (e.g. uploading with --acl public-read); ACLs that existed before are unaffected
    • Through any ACLsIgnorePublicAcls
    • Through new public bucket policiesBlockPublicPolicyOnce on, S3 rejects any attempt to save a public bucket policy (e.g. Principal: "*"); policies that existed before are unaffected
    • Through any public bucket policiesRestrictPublicBuckets
  • How q3.pdf was encrypted when uploadedChanging the bucket's default encryption doesn't re-encrypt an existing q3.pdf
KMS key policyKMS keyput-key-policy
"Enable IAM User Permissions": lets IAM policies in the account grant access to this key
2 statements: KeyAdmin, :root
{ "Statement": [
{
  "Sid": "Allow access for Key Administrators",
  "Effect": "Allow",
  "Principal": { "AWS": "arn:aws:iam::111122223333:role/KeyAdmin" },
  "Action": ["kms:Describe*", "kms:Put*", "kms:ScheduleKeyDeletion"],
  "Resource": "*"
}
{
  "Sid": "Enable IAM User Permissions",
  "Effect": "Allow",
  "Principal": { "AWS": "arn:aws:iam::111122223333:root" },
  "Action": "kms:*",
  "Resource": "*"
}
] }
Bucket owner enforced (ACLs disabled): S3 ignores every ACL when checking access, so q3.pdf's object ACL, BlockPublicAcls and IgnorePublicAcls have nothing to act on
IgnorePublicAcls on: q3.pdf's AllUsers grant does not count
RestrictPublicBuckets on: the public statement only works for the same account and AWS services, not anonymous requests
SSE-S3 uses no KMS key, so the key policy and its :root statement play no part
SSE-S3 uses no KMS key, so the key policy and its :root statement play no part

Anonymous request: unsigned. Reader: role in the same account, identity-based policy allows s3:GetObject on reports/*. BlockPublicAcls and BlockPublicPolicy only reject future writes; existing grants and statements are not affected. Assumes Reader's policy also allows kms:Decrypt. Account and organization level Block Public Access also exist; not drawn here.

  • Anyone (unsigned) can read q3.pdf
  • Reader can read q3.pdf
  • Someone allowed to upload can upload q3.pdf with --acl public-read
  • A bucket policy letting anyone read (Principal: "*") can be saved

Hover a result. Blue: related settings; pink: what currently decides this result

bucket policyS3 bucketput-bucket-policy
statement: one rule inside the bucket policy; a policy can hold several
{ "Version": "2012-10-17", "Statement": [
{
  "Effect": "Allow",
  "Principal": { "AWS": "arn:aws:iam::111122223333:role/Reader" },
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::reports/*"
}
{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::reports/*"
}
{
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::reports/*",
  "Condition": { "StringEquals": { "aws:PrincipalType": "Anonymous" } }
}
] }
q3.pdf's object ACL (one per object)S3 objectput-object-acl
<Grant>
  <Grantee xsi:type="Group">
    <URI>http://acs.amazonaws.com/groups/global/AllUsers</URI>
  </Grantee>
  <Permission>READ</Permission>
</Grant>