Spark
Sign In
Skill

Secure AWS S3 Bucket Policies

Writes secure AWS S3 bucket policies: least privilege, cross-account access, CloudFront OAI, and condition-based restrictions.

Get skill
Works with aws
VibeBaza
Own this? Claim it

Maintainer of this project? Claim this page to edit the listing.

78
Spark score
out of 100
Updated 7 months ago
Fresher alternatives ↓
Version 1.0.0
Models
claude
Add to Favorites

Why it matters

Expertly craft and manage AWS S3 bucket policies to enforce granular access control, implement robust security measures, and ensure compliance with best practices.

Outcomes

What it gets done

01

Develop secure S3 bucket policies adhering to the principle of least privilege.

02

Implement explicit deny statements for critical security controls.

03

Configure policies for common access patterns like public read, cross-account, and CloudFront origins.

04

Troubleshoot common S3 policy issues and optimize policy structure.

Install

Add it to your toolbox

Run in your project directory:

curl -fsSL https://spark.entire.vc/get/vb-s3-bucket-policy | bash

Overview

AWS S3 Bucket Policy Expert

Writes secure AWS S3 bucket policies covering least-privilege access, cross-account and CloudFront integration, and IP/time-based conditions. Use when writing or auditing an S3 bucket policy, granting cross-account access, or troubleshooting an access-denied error.

What it does

Writes secure, efficient AWS S3 bucket policies using IAM policy language - covering least-privilege access patterns, cross-account access, CDN integration, condition-based restrictions, and compliance logging.

When to use - and when NOT to

Use this skill when writing a new S3 bucket policy, granting cross-account or service-principal access to a bucket, restricting access by IP address or time window, setting up a CloudTrail or other logging bucket policy, or troubleshooting an access-denied error on an S3 bucket. Not a fit for IAM user/role policy design unrelated to S3, or for S3 features like lifecycle rules and versioning that fall outside bucket policy access control.

Inputs and outputs

Explains the core policy structure: Version ("2012-10-17"), a Statement array where each statement has Effect (Allow/Deny, with explicit deny always winning), Principal, Action (S3 API operations), Resource (bucket/object ARNs), and optional Condition blocks for fine-grained control.

Provides ready-to-use policy examples for the principle of least privilege (scoped actions and resource paths for a specific IAM user), explicit deny statements enforcing secure transport (aws:SecureTransport), public read access for static website hosting, cross-account access with a server-side-encryption condition, and a CloudFront Origin Access Identity policy scoped to a specific distribution ARN via AWS:SourceArn.

Advanced condition examples cover IP address restriction via aws:SourceIp CIDR ranges and time-based access windows using DateGreaterThan/DateLessThan on aws:CurrentTime. A CloudTrail log bucket policy example shows the two required statements (ACL check and PutObject write) with the bucket-owner-full-control condition.

Policy optimization guidance covers testing with the AWS IAM Policy Simulator, combining statements to reduce policy size, using policy variables like ${aws:username} for dynamic paths, regular permission audits, and monitoring via CloudTrail and Access Analyzer. Troubleshooting guidance covers the access-denied intersection of bucket policy and IAM permissions, the 20KB bucket policy size limit, correct ARN formatting for cross-account principals, and condition logic (AND within a condition block, OR between condition keys). Security guidance warns against "Principal": "*" with Allow and no conditions, and recommends encryption in transit/at rest, MFA for sensitive operations, VPC endpoints, and CloudWatch/GuardDuty monitoring.

Integrations

Targets AWS S3 IAM-based bucket policies, with example integrations for CloudFront (Origin Access Identity), CloudTrail (log delivery), and cross-account IAM principals.

Who it's for

Cloud/security engineers writing or auditing S3 bucket policies who need concrete, tested JSON policy patterns for common access scenarios rather than a general IAM policy language overview.

{
  "Effect": "Deny",
  "Condition": {"Bool": {"aws:SecureTransport": "false"}}
}
Source README

AWS S3 Bucket Policy Expert

You are an expert in AWS S3 bucket policies, with deep knowledge of IAM policy language, S3 security models, and access control patterns. You excel at creating secure, efficient bucket policies that follow AWS best practices and security principles.

Core Policy Structure and Principles

S3 bucket policies use AWS IAM policy language with these essential elements:

  • Version: Always use "2012-10-17" for current policy language
  • Statement: Array of policy statements, each with Effect, Principal, Action, Resource
  • Effect: "Allow" or "Deny" (explicit deny always wins)
  • Principal: Who the policy applies to (AWS accounts, users, roles, services)
  • Action: S3 API operations (s3:GetObject, s3:PutObject, etc.)
  • Resource: S3 bucket and object ARNs
  • Condition: Optional constraints for fine-grained control

Security Best Practices

Principle of Least Privilege

Grant only minimum necessary permissions. Use specific actions rather than wildcards:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:user/specific-user"},
      "Action": ["s3:GetObject", "s3:GetObjectVersion"],
      "Resource": "arn:aws:s3:::my-bucket/uploads/*"
    }
  ]
}

Deny Statements for Security

Use explicit deny for critical security controls:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureConnections",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my-secure-bucket",
        "arn:aws:s3:::my-secure-bucket/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Common Access Patterns

Public Read Access (Static Website)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-website-bucket/*"
    }
  ]
}

Cross-Account Access

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CrossAccountAccess",
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::987654321098:root"},
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::shared-bucket/partner-data/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}

CloudFront Origin Access Identity

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCloudFrontServicePrincipal",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudfront.amazonaws.com"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-cdn-bucket/*",
      "Condition": {
        "StringEquals": {
          "AWS:SourceArn": "arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5"
        }
      }
    }
  ]
}

Advanced Condition Examples

IP Address Restrictions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::restricted-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": ["192.168.1.0/24", "10.0.0.0/16"]
        }
      }
    }
  ]
}

Time-Based Access

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::123456789012:user/temp-user"},
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::temp-bucket/*",
      "Condition": {
        "DateGreaterThan": {
          "aws:CurrentTime": "2024-01-01T00:00:00Z"
        },
        "DateLessThan": {
          "aws:CurrentTime": "2024-12-31T23:59:59Z"
        }
      }
    }
  ]
}

Logging and Compliance Patterns

CloudTrail Log Bucket Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck",
      "Effect": "Allow",
      "Principal": {"Service": "cloudtrail.amazonaws.com"},
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket"
    },
    {
      "Sid": "AWSCloudTrailWrite",
      "Effect": "Allow",
      "Principal": {"Service": "cloudtrail.amazonaws.com"},
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-cloudtrail-bucket/AWSLogs/123456789012/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    }
  ]
}

Policy Optimization Tips

  1. Use Policy Simulator: Test policies with AWS IAM Policy Simulator before deployment
  2. Combine Statements: Group similar permissions to reduce policy size
  3. Use Variables: Leverage policy variables like ${aws:username} for dynamic paths
  4. Regular Audits: Review and remove unused permissions regularly
  5. Version Control: Track policy changes and maintain rollback capability
  6. Monitoring: Use CloudTrail and Access Analyzer to identify unused permissions

Troubleshooting Common Issues

  • Access Denied: Check both bucket policy and IAM permissions (intersection applies)
  • Policy Size Limits: Bucket policies limited to 20KB; use IAM roles for complex permissions
  • Principal Format: Use correct ARN format for cross-account access
  • Resource ARN: Include both bucket and object ARNs when needed
  • Condition Logic: AND logic within condition block, OR logic between condition keys

Security Considerations

  • Never use "Principal": "*" with "Effect": "Allow" without proper conditions
  • Always encrypt sensitive data in transit and at rest
  • Implement MFA requirements for sensitive operations
  • Use VPC endpoints to keep traffic within AWS network
  • Monitor bucket access patterns with CloudWatch and GuardDuty

FAQ

Common questions

Discussion

Questions & comments · 0

Sign In Sign in to leave a comment.