Question

I’m trying to set Read-Only access to a specific folder on Amazon. I have a ‘corporate’ bucket and folder ‘software’ inside it. For some reason the following code doesn’t work for me (I’m using CloudBerry for the verification):

{
    "Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:Get*",
            "s3:List*"
        ],
        "Resource": "arn:aws:s3:::corporate/software/*"
    }
    ]
}

But if I use:

"Resource": "*"

I’m able to see all the buckets…
Am I missing something?

Answer 1

Code below worked for me:

{
    "Statement": [
{
    "Effect": "Allow",
    "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketMultipartUploads"
    ],
    "Resource": "arn:aws:s3:::corporate",
    "Condition": {}
    },
    {
    "Effect": "Allow",
    "Action": [
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl"
    ],
    "Resource": "arn:aws:s3:::corporate/software/*",
    "Condition": {}
    },
    {
        "Effect": "Allow",
        "Action": "s3:ListAllMyBuckets",
        "Resource": "*",
        "Condition": {}
    }
]
}