AWS S3 bucket to private user

private-s3-gist.md

S3 bucket to private user

0. Create a IAM policy called s3-admin-nexus-s3-bucket. It will be used later.

{    
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::nexus-s3-bucket-test/",
                "arn:aws:s3:::nexus-s3-bucket-test"
            ]
        }
    ]
}

1. Create a user with programmatic access called test-s3 and apply the following policy to it.

2. Download and configure credentials with aws configure.

3. Create a bucket nexus-s3-bucket-test.

4. Apply the following policy to bucket:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Private bucket for test-s3 user",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<copy-your-id-here>:user/test-s3"
            },
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::nexus-s3-bucket-test/*"
        }
    ]
}

5. List specific bucket on terminal with:

aws s3 ls s3://nexus-s3-bucket-test

Any diferent name for bucket will give permission denied error.

6. Copy a local file to bucket:

aws s3 cp index.html s3://nexus-s3-bucket-test
$ aws s3 ls s3://nexus-s3-bucket-test
2019-08-02 21:33:04          5 index.html

6.5 (Optional) let file as public read

aws s3api put-object-acl --bucket nexus-s3-bucket-test --key index.html --acl public-read
curl  https://nexus-s3-bucket-test.s3.amazonaws.com/index.html

7. Go to IAM, in order to create a role s3-admin-nexus-s3 and apply the s3-admin-nexus-s3-bucket policy.
8. Go to web console, select desired instance, menu Actions -> Instance Settings -> Attach/Replace IAM Role.
9. Select the s3-admin-nexus-s3 on the list, then click Apply.
10. Connect to instance and list bucket objects:

aws s3 ls s3://nexus-s3-bucket-test