Programmatic file upload to AWS S3 bucket

Question

I want to provision an AWS S3 bucket and an IAM user (with programmatic access only) so I can facilitate file upload privilege for that user only. The user will receive the AWS access key ID and secret access key, to use in a simple Node.js or Python console application. What are the minimal steps required to achieve this?

Create an IAM user (with programmatic access), with no permissions - DONE
Create a S3 bucket and block all public access - DONE
Add a bucket policy that looks like this:

{
    "Version": "2012-10-17",
    "Id": "Policy1234567",
    "Statement": [
        {
            "Sid": "Stmt1234567",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::1234567890:user/someuser"
            },
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::some-bucket-name/*"
        }
    ]
}

I have a simple node.js application that will upload a given file to the bucket:

const fs = require('fs');
const zlib = require('zlib');
const AWS = require('aws-sdk');
const s3 = new AWS.S3({
  accessKeyId: process.env.AWS_ACCESS_KEY,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY
});

const bucketName = 'some-bucket-name';
const fileName = 'alargefile.iso';
var body = fs.createReadStream(fileName)
             .pipe(zlib.createGzip());

// Upload the stream
var s3obj = new AWS.S3({
  accessKeyId: process.env.AWS_ACCESS_KEY,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
  params: {
    Bucket: bucketName,
    Key: fileName
  }
});
s3obj.upload({
  Body: body
}, function(err, data) {
  if (err) {
    console.log("An error occurred", err);
  }
  else {
    console.log("Uploaded the file at", data.Location);
  }
});

Since the user does not have any permissions, do I still need to create a custom policy to apply as a permission for the user? The OOTB policies are either too generous (AmazonS3FullAccess) or too restrictive (AmazonS3ReadOnlyAccess). Another bit of confusion is that I have set a bucket policy that regulates access to the bucket for a specific user, so would that not be sufficient?

bgdnlp · Accepted Answer · 2019-06-23 13:40:25Z

2

You can create custom policy for IAM user as well, where you only allow PUTObject to specific bucket.

example:

{
    "Version": "2012-10-17",
    "Id": "Policy1234567",
    "Statement": [
        {
            "Sid": "Stmt1234567",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::some-bucket-name/*"
        }
    ]
}

If the bucket and IAM user are in the same account, you don't need bucket policy if IAM user has the above policy.

You definitely need Identity policy based on below link:

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html

edited Jun 23, 2019 at 13:40

bgdnlp

1,27513 silver badges14 bronze badges

answered Jun 22, 2019 at 17:23

James Dean

4,5211 gold badge12 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Programmatic file upload to AWS S3 bucket

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related