AWS S3 bucket control policy for cross-account access

up vote
0
down vote

favorite

I have S3 bucket called "atest-bucket". Inside of this bucket I have directory named "data". I need to provide access to user from external account to this directory (this user will access my data in order to run AWS ElasticMapReduce job).

With the policy I created, user still getting 403, when trying access it:

Access Denied (Service: Amazon S3; Status Code: 403; Error Code:
AccessDenied;

Here is my policy:

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Sid": "AccessToDataFiles",

            "Effect": "Allow",

            "Principal": {

                "AWS": [

                    "arn:aws:iam::11111111111:user/emr",

                   "arn:aws:iam::11111111111:role/EMR_EC2_DefaultRole"

                ]

            },

            "Action": "s3:List*",

            "Resource": "arn:aws:s3:::atest-bucket/data"

        },

        {

            "Sid": "Stmt1234456",

            "Effect": "Allow",

            "Principal": {

                "AWS": [

                    "arn:aws:iam::11111111111:user/emr",

                   "arn:aws:iam::11111111111:role/EMR_EC2_DefaultRole"

                ]

            },

            "Action": [

                "s3:Get*",

                "s3:List*",

                "s3:Put*"

            ],

            "Resource": "arn:aws:s3:::atest-bucket/data/*"

        }

    ]

}

Please help me investigate this issue.

asked Nov 21 at 5:37

HelloWorld

3517

1

Refer this aws.amazon.com/premiumsupport/knowledge-center/…
– Shiv Rajawat
Nov 21 at 6:19

1

When you say "when trying access it", what specific command did you use? Also, what S3-related permissions does the user/role in the other account have? (They need permission to call S3 granted by their own account AND they need permission via the Bucket Policy.)
– John Rotenstein
Nov 21 at 9:45

add a comment |

up vote
0
down vote

favorite

With the policy I created, user still getting 403, when trying access it:

Access Denied (Service: Amazon S3; Status Code: 403; Error Code:
AccessDenied;

Here is my policy:

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Sid": "AccessToDataFiles",

            "Effect": "Allow",

            "Principal": {

                "AWS": [

                    "arn:aws:iam::11111111111:user/emr",

                   "arn:aws:iam::11111111111:role/EMR_EC2_DefaultRole"

                ]

            },

            "Action": "s3:List*",

            "Resource": "arn:aws:s3:::atest-bucket/data"

        },

        {

            "Sid": "Stmt1234456",

            "Effect": "Allow",

            "Principal": {

                "AWS": [

                    "arn:aws:iam::11111111111:user/emr",

                   "arn:aws:iam::11111111111:role/EMR_EC2_DefaultRole"

                ]

            },

            "Action": [

                "s3:Get*",

                "s3:List*",

                "s3:Put*"

            ],

            "Resource": "arn:aws:s3:::atest-bucket/data/*"

        }

    ]

}

Please help me investigate this issue.

asked Nov 21 at 5:37

HelloWorld

3517

1

Refer this aws.amazon.com/premiumsupport/knowledge-center/…
– Shiv Rajawat
Nov 21 at 6:19

1

When you say "when trying access it", what specific command did you use? Also, what S3-related permissions does the user/role in the other account have? (They need permission to call S3 granted by their own account AND they need permission via the Bucket Policy.)
– John Rotenstein
Nov 21 at 9:45

add a comment |

up vote
0
down vote

favorite

With the policy I created, user still getting 403, when trying access it:

Access Denied (Service: Amazon S3; Status Code: 403; Error Code:
AccessDenied;

Here is my policy:

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Sid": "AccessToDataFiles",

            "Effect": "Allow",

            "Principal": {

                "AWS": [

                    "arn:aws:iam::11111111111:user/emr",

                   "arn:aws:iam::11111111111:role/EMR_EC2_DefaultRole"

                ]

            },

            "Action": "s3:List*",

            "Resource": "arn:aws:s3:::atest-bucket/data"

        },

        {

            "Sid": "Stmt1234456",

            "Effect": "Allow",

            "Principal": {

                "AWS": [

                    "arn:aws:iam::11111111111:user/emr",

                   "arn:aws:iam::11111111111:role/EMR_EC2_DefaultRole"

                ]

            },

            "Action": [

                "s3:Get*",

                "s3:List*",

                "s3:Put*"

            ],

            "Resource": "arn:aws:s3:::atest-bucket/data/*"

        }

    ]

}

Please help me investigate this issue.

asked Nov 21 at 5:37

HelloWorld

3517

With the policy I created, user still getting 403, when trying access it:

Access Denied (Service: Amazon S3; Status Code: 403; Error Code:
AccessDenied;

Here is my policy:

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Sid": "AccessToDataFiles",

            "Effect": "Allow",

            "Principal": {

                "AWS": [

                    "arn:aws:iam::11111111111:user/emr",

                   "arn:aws:iam::11111111111:role/EMR_EC2_DefaultRole"

                ]

            },

            "Action": "s3:List*",

            "Resource": "arn:aws:s3:::atest-bucket/data"

        },

        {

            "Sid": "Stmt1234456",

            "Effect": "Allow",

            "Principal": {

                "AWS": [

                    "arn:aws:iam::11111111111:user/emr",

                   "arn:aws:iam::11111111111:role/EMR_EC2_DefaultRole"

                ]

            },

            "Action": [

                "s3:Get*",

                "s3:List*",

                "s3:Put*"

            ],

            "Resource": "arn:aws:s3:::atest-bucket/data/*"

        }

    ]

}

Please help me investigate this issue.

amazon-web-services amazon-s3 amazon-iam amazon-emr

asked Nov 21 at 5:37

HelloWorld

3517

asked Nov 21 at 5:37

HelloWorld

3517

asked Nov 21 at 5:37

HelloWorld

3517

asked Nov 21 at 5:37

HelloWorld

3517

asked Nov 21 at 5:37

HelloWorld

3517

1

Refer this aws.amazon.com/premiumsupport/knowledge-center/…
– Shiv Rajawat
Nov 21 at 6:19

1

When you say "when trying access it", what specific command did you use? Also, what S3-related permissions does the user/role in the other account have? (They need permission to call S3 granted by their own account AND they need permission via the Bucket Policy.)
– John Rotenstein
Nov 21 at 9:45

add a comment |

1

Refer this aws.amazon.com/premiumsupport/knowledge-center/…
– Shiv Rajawat
Nov 21 at 6:19

1

When you say "when trying access it", what specific command did you use? Also, what S3-related permissions does the user/role in the other account have? (They need permission to call S3 granted by their own account AND they need permission via the Bucket Policy.)
– John Rotenstein
Nov 21 at 9:45

Refer this aws.amazon.com/premiumsupport/knowledge-center/…
– Shiv Rajawat
Nov 21 at 6:19

When you say "when trying access it", what specific command did you use? Also, what S3-related permissions does the user/role in the other account have? (They need permission to call S3 granted by their own account AND they need permission via the Bucket Policy.)
– John Rotenstein
Nov 21 at 9:45

add a comment |

1 Answer
1

active

oldest

votes

up vote
1
down vote

accepted

I believe you granted permission for another account(111----------). In this account you need to delegate further permission to specific user that you are using.
You need to delegate permission to your user for accessing the bucket created by previous account.

Create inline policy for the user in account(111----------):

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Example",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::examplebucket"
]
}
]
}

Please refer the following url:
https://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html

answered Nov 21 at 10:08

Dharmesh Purohit

462

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53405831%2faws-s3-bucket-control-policy-for-cross-account-access%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
1
down vote

accepted

Create inline policy for the user in account(111----------):

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Example",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::examplebucket"
]
}
]
}

Please refer the following url:
https://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html

answered Nov 21 at 10:08

Dharmesh Purohit

462

add a comment |

up vote
1
down vote

accepted

Create inline policy for the user in account(111----------):

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Example",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::examplebucket"
]
}
]
}

Please refer the following url:
https://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html

answered Nov 21 at 10:08

Dharmesh Purohit

462

add a comment |

up vote
1
down vote

accepted

Create inline policy for the user in account(111----------):

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Example",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::examplebucket"
]
}
]
}

Please refer the following url:
https://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html

answered Nov 21 at 10:08

Dharmesh Purohit

462

Create inline policy for the user in account(111----------):

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Example",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::examplebucket"
]
}
]
}

Please refer the following url:
https://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html

answered Nov 21 at 10:08

Dharmesh Purohit

462

answered Nov 21 at 10:08

Dharmesh Purohit

462

answered Nov 21 at 10:08

Dharmesh Purohit

462

answered Nov 21 at 10:08

Dharmesh Purohit

462

add a comment |

draft saved

draft discarded

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Htykuut