How can I apply least privilege to an IAM role that only needs read access to a specific S3 bucket?

Question

How can I apply least privilege to an IAM role that only needs read access to a specific S3 bucket?

Reginaldo Dan Mayhuire Buendia 0

I am learning about cloud security and the principle of least privilege. I need to create an IAM role for an application that should only be able to read objects from one specific S3 bucket, without permissions to upload, delete, modify objects, or access other buckets. What IAM permissions should I include in the policy to achieve this? Also, is it better to assign the permissions directly to the role or use another AWS security mechanism for this scenario? I want to avoid using broad permissions such as AmazonS3ReadOnlyAccess if they give access to other S3 buckets.

0 comments

1 answer

Your answer

Answer 1

This forum is intended for Microsoft technologies, but since you asked... ;)

Create a custom IAM policy that grants only the S3 actions the application needs and scope those actions to the specific bucket and its objects. For read-only access to objects, the key permission is s3:GetObject on the object ARN, such as arn:aws:s3:::my-specific-bucket/*. If the application also needs to list objects in the bucket, add s3:ListBucket scoped to the bucket ARN itself, arn:aws:s3:::my-specific-bucket. You do not need s3:PutObject, s3:DeleteObject, s3:PutObjectAcl, or other write permissions.

A policy would look like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-specific-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-specific-bucket"
    }
  ]
}

If the application already knows the exact object keys it needs and does not need to enumerate the bucket, you can omit s3:ListBucket and grant only s3:GetObject. This is even more restrictive. Also, GetObject does not automatically grant access to other buckets. The resource ARN limits the permission to objects within the specified bucket.

For this scenario, attaching the custom policy directly to the IAM role is the AWS mechanism. The application assumes that role, and the role provides its temporary credentials with only the permissions defined by the policy. You do not need AmazonS3ReadOnlyAccess, because that AWS managed policy is intentionally broader and can grant read access across S3 resources rather than limiting the application to one bucket. A bucket policy can also be used, particularly when the bucket needs to control access from another AWS account, but for an application role in the same account, a scoped identity-based policy on the role is a relatively straightforward least-privilege design.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin