How do i grant a customer read/write access to a specific S3 bucket in my AWS account without giving them access to any other buckets or resources?

They should be able to access this bucket from a powershell script in some ec2 instance of theirs.

found this policy

{
    "Version": "2012-10-17",
    "Id": "PolicyForBucketX",
    "Statement": [
        {
            "Sid": "AllowCustomerRWAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:root"
            },
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::bucket-x/*"
        }
    ]
}

Giving customer AWS access to my AWS's specific s3 bucket?

with this, they might be able to access s3 via their access key in powershell. However they might not be using access key hardcoded to use s3. They might be using STS with instance role for the ec2 to access their s3 resources.

Would this work still? Would they then have to add my bucket x into their instance role permissions buckets?

Any better way? I might/might not have details of their AWS resource IDs.

CodePudding user response：

With Bucket policy and IAM policy (either for user or a role) you can restrict users/resources based on the requirement. I agree with Maurice here as extent of restriction would heavily depend on what you specifically want to do.

You can also use CloudFront and restrict access to your bucket objects for users not managed by IAM.

CodePudding user response：

In general you should think of access as two part task. On the side of the resource, you grant permissions to a resource, in this case you are doing that for a specific bucket (resource) for a cross account (principal). You're done.

Now, the identity that will access it will also needs permissions given to them by the account administrator (root) the same way. I.e. grant the user/role the permissions to

"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"

If they would like to use an instance which has AWS PowerShell installed, they can create an instance profile / role that has the above permissions, and they will be able to run the commands and access your bucket. That's right way to do it.

Regardless of how they access to the instance, when they make the api call from the instance to your bucket, AWS will first check to see if the caller (which could be instance profile or a role they assumed) has permissions to these actions (customer setup). It will then be checked to see if the resource allows these actions (your setup).