Security AWS S3 Buckets using S3 Buckets Policy


You can secure AWS S3 buckets using a bucket policy involves defining a set of permissions that explicitly control access to the bucket and its contents. Bucket policies are JSON documents that define which actions are allowed or denied for specific principals (users, roles, services) under certain conditions.

Here are the key steps and examples to secure your AWS S3 bucket using a bucket policy:

1. Access Over SSL only

To ensure that your bucket is only accessible over TLS, you can deny all other traffic by configuring the bucket policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::YOUR_BUCKET_NAME",
        "arn:aws:s3:::YOUR_BUCKET_NAME/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Explanation:

2. Allow Access Only from Specific IPs

To restrict access to a bucket based on IP address ranges, use the IpAddress condition.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    }
  ]
}

Explanation:

3. Allow Access to Specific IAM Roles or Users

To give access only to specific AWS IAM users or roles, you can specify their ARN (Amazon Resource Name) in the Principal field.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME"
      },
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
    }
  ]
}

Explanation:

4. Require Multi-Factor Authentication (MFA) for Sensitive Actions

To enforce MFA for specific actions, such as deleting objects, use the aws:MultiFactorAuthPresent condition.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*",
      "Condition": {
        "BoolIfExists": {
          "aws:MultiFactorAuthPresent": "false"
        }
      }
    }
  ]
}

Explanation:

5. Enforce Encrypted Uploads

To require that all objects uploaded to the S3 bucket are encrypted with server-side encryption (SSE), you can use a condition on the s3:x-amz-server-side-encryption key.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}

Explanation:

6. Allow Read-Only Access to Specific AWS Account

To grant read-only access to another AWS account, use the Principal field to specify the AWS account’s ID.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ANOTHER_ACCOUNT_ID:root"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
    }
  ]
}

Explanation:

7. Restricting Access to VPC Endpoint

If your S3 bucket needs to be accessed only through a VPC (Virtual Private Cloud) endpoint, use the aws:SourceVpc condition.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::YOUR_BUCKET_NAME",
        "arn:aws:s3:::YOUR_BUCKET_NAME/*"
      ],
      "Condition": {
        "StringNotEquals": {
          "aws:SourceVpc": "vpc-987654321"
        }
      }
    }
  ]
}

Explanation:

8. Granting Access to CloudFront for Website Hosting

If you are using CloudFront to serve content from your S3 bucket, you can grant CloudFront access using the OAI (Origin Access Identity).

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "CanonicalUser": "CLOUDFRONT_OAI_ID"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
    }
  ]
}

Explanation:

9. Bucket Policy for Access Points

Access Points provide access to your S3 bucket using a different endpoint. You can restrict permissions at the access point level and need not worry about accidental policy changes. To use access point, you need both an access point policy and a bucket policy.

Here’s the access point policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT_ID:role/RoleName"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:ap-southeast-2:ACCOUNT_ID:accesspoint/your-access-point/object/*"
    }
  ]
}

Explanation:

Here’s the bucket policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*",
      "Condition": {
        "StringEquals": {
          "s3:DataAccessPointAccount": "ACCOUNT_ID"
        }
      }
    }
  ]
}

Explanation:

Additional Consideration


Related pages

S3 - simple storage service Security in S3 Secure S3 Bucket using Bucket Policy True costs of storing data in S3 Lifecycle Policy S3 Object Metadata S3 Storage Classes

AWS S3