Skip to content

Instantly share code, notes, and snippets.

@mohakevin

mohakevin/README.md

Forked from magnetikonline/README.md
Created September 16, 2016 22:33
Show Gist options
  • Save mohakevin/2714da930b5c2bc7e74a03a84c31f9a0 to your computer and use it in GitHub Desktop.
Save mohakevin/2714da930b5c2bc7e74a03a84c31f9a0 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @magnetikonline magnetikonline revised this gist Aug 23, 2016. 1 changed file with 5 additions and 4 deletions.
    9 changes: 5 additions & 4 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -179,8 +179,9 @@
    ```

    **Note:** This policy effectively provides protected user folders within an S3 bucket:
    - The first `s3:ListBucket` action allows *listing only* of object paths at the root and under `BUCKET_PATH/`.
    - The second `s3:ListBucket` allows for listing of all objects from the path of `BUCKET_PATH/BUCKET_SUB_PATH/` and below.
    - The first `s3:ListBucket` action allows *listing only* of objects at the bucket root and under `BUCKET_PATH/`.
    - The second `s3:ListBucket` action allows listing of objects from the path of `BUCKET_PATH/BUCKET_SUB_PATH/` and below.
    - Technique is covered [here](http://blogs.aws.amazon.com/security/post/Tx1P2T3LFXXCNB5/Writing-IAM-policies-Grant-access-to-user-specific-folders-in-an-Amazon-S3-bucke) under the heading _Block 2: Allow listing objects in root and home folders_.

    ## Full access (and S3 console) for specific IAM users
    **Type:** user/group
    @@ -212,8 +213,8 @@
    ```

    ## Reference
    - http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket
    - http://blogs.aws.amazon.com/security/post/Tx1P2T3LFXXCNB5/Writing-IAM-policies-Grant-access-to-user-specific-folders-in-an-Amazon-S3-bucke
    - Writing IAM Policies: How to Grant Access to an Amazon S3 Bucket: http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket
    - Writing IAM Policies: Grant Access to User-Specific Folders in an Amazon S3 Bucket: http://blogs.aws.amazon.com/security/post/Tx1P2T3LFXXCNB5/Writing-IAM-policies-Grant-access-to-user-specific-folders-in-an-Amazon-S3-bucke
    - Summary of S3 `Action` types and their use: http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
    - http://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html
    - http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_examples.html
  2. @magnetikonline magnetikonline revised this gist Jun 29, 2016. 1 changed file with 7 additions and 6 deletions.
    13 changes: 7 additions & 6 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -2,8 +2,8 @@
    - [Anonymous GET access](#anonymous-get-access)
    - [Anonymous GET access - match HTTP referrer](#anonymous-get-access---match-http-referrer)
    - [Full access for specific IAM user/role](#full-access-for-specific-iam-userrole)
    - [Put/delete access to specific path within a bucket](#putdelete-access-to-specific-path-within-a-bucket)
    - [List/put/delete access to specific path within a bucket](#listputdelete-access-to-specific-path-within-a-bucket)
    - [GET/PUT/DELETE access to specific path within a bucket](#getputdelete-access-to-specific-path-within-a-bucket)
    - [LIST/PUT/DELETE access to specific path within a bucket](#listputdelete-access-to-specific-path-within-a-bucket)
    - [Full access (and S3 console) for specific IAM users](#full-access-and-s3-console-for-specific-iam-users)

    ## Anonymous GET access
    @@ -95,7 +95,7 @@
    }
    ```

    ## Put/delete access to specific path within a bucket
    ## GET/PUT/DELETE access to specific path within a bucket
    **Type:** user/group

    ```json
    @@ -114,6 +114,7 @@
    {
    "Action": [
    "s3:DeleteObject",
    "s3:GetObject",
    "s3:PutObject"
    ],
    "Effect": "Allow",
    @@ -125,9 +126,9 @@
    }
    ```

    **Note:** The `s3:ListBucket` action against the bucket as a whole allows for the *listing* of bucket objects.
    **Note:** The [`s3:ListBucket`](http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html#using-with-s3-actions-related-to-buckets) action against the bucket as a whole allows for the *listing* of bucket objects.

    ## List/put/delete access to specific path within a bucket
    ## LIST/PUT/DELETE access to specific path within a bucket
    **Type:** user/group

    ```json
    @@ -213,6 +214,6 @@
    ## Reference
    - http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket
    - http://blogs.aws.amazon.com/security/post/Tx1P2T3LFXXCNB5/Writing-IAM-policies-Grant-access-to-user-specific-folders-in-an-Amazon-S3-bucke
    - http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
    - Summary of S3 `Action` types and their use: http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
    - http://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html
    - http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_examples.html
  3. @magnetikonline magnetikonline revised this gist Jun 29, 2016. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -215,3 +215,4 @@
    - http://blogs.aws.amazon.com/security/post/Tx1P2T3LFXXCNB5/Writing-IAM-policies-Grant-access-to-user-specific-folders-in-an-Amazon-S3-bucke
    - http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
    - http://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html
    - http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_examples.html
  4. @magnetikonline magnetikonline revised this gist Aug 19, 2015. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -177,7 +177,9 @@
    }
    ```

    **Note:** This policy effectively provides protected user folders within an S3 bucket. The first `s3:ListBucket` action allows *listing only* of object paths at the root and under `BUCKET_PATH/`. The second `s3:ListBucket` allows for listing of all objects from the path of `BUCKET_PATH/BUCKET_SUB_PATH/` and below.
    **Note:** This policy effectively provides protected user folders within an S3 bucket:
    - The first `s3:ListBucket` action allows *listing only* of object paths at the root and under `BUCKET_PATH/`.
    - The second `s3:ListBucket` allows for listing of all objects from the path of `BUCKET_PATH/BUCKET_SUB_PATH/` and below.

    ## Full access (and S3 console) for specific IAM users
    **Type:** user/group
  5. @magnetikonline magnetikonline revised this gist Aug 19, 2015. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -125,7 +125,7 @@
    }
    ```

    Note: The `s3:ListBucket` action against the bucket as a whole allows for the *listing* of bucket objects.
    **Note:** The `s3:ListBucket` action against the bucket as a whole allows for the *listing* of bucket objects.

    ## List/put/delete access to specific path within a bucket
    **Type:** user/group
    @@ -177,6 +177,8 @@ Note: The `s3:ListBucket` action against the bucket as a whole allows for the *l
    }
    ```

    **Note:** This policy effectively provides protected user folders within an S3 bucket. The first `s3:ListBucket` action allows *listing only* of object paths at the root and under `BUCKET_PATH/`. The second `s3:ListBucket` allows for listing of all objects from the path of `BUCKET_PATH/BUCKET_SUB_PATH/` and below.

    ## Full access (and S3 console) for specific IAM users
    **Type:** user/group

  6. @magnetikonline magnetikonline revised this gist Jul 7, 2015. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -210,3 +210,4 @@ Note: The `s3:ListBucket` action against the bucket as a whole allows for the *l
    - http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket
    - http://blogs.aws.amazon.com/security/post/Tx1P2T3LFXXCNB5/Writing-IAM-policies-Grant-access-to-user-specific-folders-in-an-Amazon-S3-bucke
    - http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
    - http://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html
  7. @magnetikonline magnetikonline revised this gist Jul 6, 2015. 1 changed file with 52 additions and 0 deletions.
    52 changes: 52 additions & 0 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -3,6 +3,7 @@
    - [Anonymous GET access - match HTTP referrer](#anonymous-get-access---match-http-referrer)
    - [Full access for specific IAM user/role](#full-access-for-specific-iam-userrole)
    - [Put/delete access to specific path within a bucket](#putdelete-access-to-specific-path-within-a-bucket)
    - [List/put/delete access to specific path within a bucket](#listputdelete-access-to-specific-path-within-a-bucket)
    - [Full access (and S3 console) for specific IAM users](#full-access-and-s3-console-for-specific-iam-users)

    ## Anonymous GET access
    @@ -126,6 +127,56 @@

    Note: The `s3:ListBucket` action against the bucket as a whole allows for the *listing* of bucket objects.

    ## List/put/delete access to specific path within a bucket
    **Type:** user/group

    ```json
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Action": [
    "s3:ListBucket"
    ],
    "Condition": {
    "StringEquals": {
    "s3:delimiter": ["/"],
    "s3:prefix": ["","BUCKET_PATH/"]
    }
    },
    "Effect": "Allow",
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME"
    ]
    },
    {
    "Action": [
    "s3:ListBucket"
    ],
    "Condition": {
    "StringLike": {
    "s3:prefix": ["BUCKET_PATH/BUCKET_SUB_PATH/*"]
    }
    },
    "Effect": "Allow",
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME"
    ]
    },
    {
    "Action": [
    "s3:DeleteObject",
    "s3:PutObject"
    ],
    "Effect": "Allow",
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME/BUCKET_PATH/BUCKET_SUB_PATH/*"
    ]
    }
    ]
    }
    ```

    ## Full access (and S3 console) for specific IAM users
    **Type:** user/group

    @@ -157,4 +208,5 @@ Note: The `s3:ListBucket` action against the bucket as a whole allows for the *l

    ## Reference
    - http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket
    - http://blogs.aws.amazon.com/security/post/Tx1P2T3LFXXCNB5/Writing-IAM-policies-Grant-access-to-user-specific-folders-in-an-Amazon-S3-bucke
    - http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
  8. @magnetikonline magnetikonline revised this gist Jul 6, 2015. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -124,6 +124,8 @@
    }
    ```

    Note: The `s3:ListBucket` action against the bucket as a whole allows for the *listing* of bucket objects.

    ## Full access (and S3 console) for specific IAM users
    **Type:** user/group

  9. @magnetikonline magnetikonline revised this gist Jul 6, 2015. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -155,3 +155,4 @@

    ## Reference
    - http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket
    - http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html
  10. @magnetikonline magnetikonline revised this gist Jul 1, 2015. 1 changed file with 38 additions and 7 deletions.
    45 changes: 38 additions & 7 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,8 +1,9 @@
    # AWS S3 bucket policy recipes
    - [Anonymous GET access](#anonymous-get-access)
    - [Anonymous GET access match HTTP referrer](#anonymous-get-access-match-http-referrer)
    - [Anonymous GET access - match HTTP referrer](#anonymous-get-access---match-http-referrer)
    - [Full access for specific IAM user/role](#full-access-for-specific-iam-userrole)
    - [Full access (and S3 weblogin) for specific IAM users](#full-access-and-s3-weblogin-for-specific-iam-users)
    - [Put/delete access to specific path within a bucket](#putdelete-access-to-specific-path-within-a-bucket)
    - [Full access (and S3 console) for specific IAM users](#full-access-and-s3-console-for-specific-iam-users)

    ## Anonymous GET access
    **Type:** bucket
    @@ -29,7 +30,7 @@
    }
    ```

    ## Anonymous GET access match HTTP referrer
    ## Anonymous GET access - match HTTP referrer
    **Type:** bucket

    ```json
    @@ -93,10 +94,38 @@
    }
    ```

    ## Full access (and S3 weblogin) for specific IAM users
    **Type:** group/user
    ## Put/delete access to specific path within a bucket
    **Type:** user/group

    **Note:** specifying both `arn:aws:s3:::BUCKET_NAME` and `arn:aws:s3:::BUCKET_NAME/*` under the `"Resource"` block allows the IAM user to list objects at the root level of the bucket.
    ```json
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Action": [
    "s3:ListBucket"
    ],
    "Effect": "Allow",
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME"
    ]
    },
    {
    "Action": [
    "s3:DeleteObject",
    "s3:PutObject"
    ],
    "Effect": "Allow",
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME/BUCKET_PATH/*"
    ]
    }
    ]
    }
    ```

    ## Full access (and S3 console) for specific IAM users
    **Type:** user/group

    ```json
    {
    @@ -117,10 +146,12 @@
    ],
    "Effect": "Allow",
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME",
    "arn:aws:s3:::BUCKET_NAME/*"
    ]
    }
    ]
    }
    ```

    ## Reference
    - http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket
  11. @magnetikonline magnetikonline revised this gist Feb 16, 2015. 1 changed file with 6 additions and 6 deletions.
    12 changes: 6 additions & 6 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -76,12 +76,12 @@
    "Effect": "Allow",
    "Principal": {
    "AWS": [
    "arn:aws:iam::ACCOUNT_NUMBER:user/USERNAME_A",
    "arn:aws:iam::ACCOUNT_NUMBER:user/USERNAME_B",
    "arn:aws:iam::ACCOUNT_NUMBER:user/USERNAME_C",
    "arn:aws:iam::ACCOUNT_NUMBER:role/ROLE_A",
    "arn:aws:iam::ACCOUNT_NUMBER:role/ROLE_B",
    "arn:aws:iam::ACCOUNT_NUMBER:role/ROLE_C"
    "arn:aws:iam::ACCOUNT_ID:user/USERNAME_A",
    "arn:aws:iam::ACCOUNT_ID:user/USERNAME_B",
    "arn:aws:iam::ACCOUNT_ID:user/USERNAME_C",
    "arn:aws:iam::ACCOUNT_ID:role/ROLE_A",
    "arn:aws:iam::ACCOUNT_ID:role/ROLE_B",
    "arn:aws:iam::ACCOUNT_ID:role/ROLE_C"
    ]
    },
    "Resource": [
  12. @magnetikonline magnetikonline revised this gist Jan 29, 2015. 1 changed file with 18 additions and 18 deletions.
    36 changes: 18 additions & 18 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -12,15 +12,15 @@
    "Version": "2012-10-17",
    "Statement": [
    {
    "Action": [
    "s3:GetObject"
    ],
    "Effect": "Allow",
    "Principal": {
    "AWS": [
    "*"
    ]
    },
    "Action": [
    "s3:GetObject"
    ],
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME/*"
    ]
    @@ -37,26 +37,26 @@
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "AWS": [
    "*"
    ]
    },
    "Action": [
    "s3:GetObject"
    ],
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME/*"
    ],
    "Condition": {
    "StringLike": {
    "aws:Referer": [
    "http://domain.com/*",
    "http://www.domain.com/*"
    ]
    }
    }
    },
    "Effect": "Allow",
    "Principal": {
    "AWS": [
    "*"
    ]
    },
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME/*"
    ]
    }
    ]
    }
    @@ -70,6 +70,9 @@
    "Version": "2012-10-17",
    "Statement": [
    {
    "Action": [
    "s3:*"
    ],
    "Effect": "Allow",
    "Principal": {
    "AWS": [
    @@ -81,9 +84,6 @@
    "arn:aws:iam::ACCOUNT_NUMBER:role/ROLE_C"
    ]
    },
    "Action": [
    "s3:*"
    ],
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME",
    "arn:aws:s3:::BUCKET_NAME/*"
    @@ -103,19 +103,19 @@
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": [
    "s3:ListAllMyBuckets"
    ],
    "Effect": "Allow",
    "Resource": [
    "arn:aws:s3:::*"
    ]
    },
    {
    "Effect": "Allow",
    "Action": [
    "s3:*"
    ],
    "Effect": "Allow",
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME",
    "arn:aws:s3:::BUCKET_NAME/*"
  13. @magnetikonline magnetikonline revised this gist Jan 29, 2015. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -95,6 +95,7 @@

    ## Full access (and S3 weblogin) for specific IAM users
    **Type:** group/user

    **Note:** specifying both `arn:aws:s3:::BUCKET_NAME` and `arn:aws:s3:::BUCKET_NAME/*` under the `"Resource"` block allows the IAM user to list objects at the root level of the bucket.

    ```json
  14. @magnetikonline magnetikonline revised this gist Aug 27, 2014. 1 changed file with 9 additions and 2 deletions.
    11 changes: 9 additions & 2 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,8 @@
    # AWS S3 bucket policy recipes
    - [Anonymous GET access](#anonymous-get-access)
    - [Anonymous GET access match HTTP referrer](#anonymous-get-access-match-http-referrer)
    - [Full access for specific IAM user/role](#full-access-for-specific-iam-userrole)
    - [Full access (and S3 weblogin) for specific IAM users](#full-access-and-s3-weblogin-for-specific-iam-users)

    ## Anonymous GET access
    **Type:** bucket
    @@ -58,7 +62,7 @@
    }
    ```

    ## Full access for specific IAM users
    ## Full access for specific IAM user/role
    **Type:** bucket

    ```json
    @@ -71,7 +75,10 @@
    "AWS": [
    "arn:aws:iam::ACCOUNT_NUMBER:user/USERNAME_A",
    "arn:aws:iam::ACCOUNT_NUMBER:user/USERNAME_B",
    "arn:aws:iam::ACCOUNT_NUMBER:user/USERNAME_C"
    "arn:aws:iam::ACCOUNT_NUMBER:user/USERNAME_C",
    "arn:aws:iam::ACCOUNT_NUMBER:role/ROLE_A",
    "arn:aws:iam::ACCOUNT_NUMBER:role/ROLE_B",
    "arn:aws:iam::ACCOUNT_NUMBER:role/ROLE_C"
    ]
    },
    "Action": [
  15. Peter Mescalchin revised this gist Aug 18, 2014. 1 changed file with 35 additions and 2 deletions.
    37 changes: 35 additions & 2 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,6 @@
    # AWS S3 bucket policy recipes

    ## Anonymous GET access (read-only)
    ## Anonymous GET access
    **Type:** bucket

    ```json
    @@ -25,6 +25,39 @@
    }
    ```

    ## Anonymous GET access match HTTP referrer
    **Type:** bucket

    ```json
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "AWS": [
    "*"
    ]
    },
    "Action": [
    "s3:GetObject"
    ],
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME/*"
    ],
    "Condition": {
    "StringLike": {
    "aws:Referer": [
    "http://domain.com/*",
    "http://www.domain.com/*"
    ]
    }
    }
    }
    ]
    }
    ```

    ## Full access for specific IAM users
    **Type:** bucket

    @@ -54,7 +87,7 @@
    ```

    ## Full access (and S3 weblogin) for specific IAM users
    **Type:** group/user
    **Type:** group/user
    **Note:** specifying both `arn:aws:s3:::BUCKET_NAME` and `arn:aws:s3:::BUCKET_NAME/*` under the `"Resource"` block allows the IAM user to list objects at the root level of the bucket.

    ```json
  16. Peter Mescalchin revised this gist Jul 29, 2014. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -45,6 +45,7 @@
    "s3:*"
    ],
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME",
    "arn:aws:s3:::BUCKET_NAME/*"
    ]
    }
  17. Peter Mescalchin created this gist May 27, 2014.
    84 changes: 84 additions & 0 deletions README.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,84 @@
    # AWS S3 bucket policy recipes

    ## Anonymous GET access (read-only)
    **Type:** bucket

    ```json
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "AWS": [
    "*"
    ]
    },
    "Action": [
    "s3:GetObject"
    ],
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME/*"
    ]
    }
    ]
    }
    ```

    ## Full access for specific IAM users
    **Type:** bucket

    ```json
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Principal": {
    "AWS": [
    "arn:aws:iam::ACCOUNT_NUMBER:user/USERNAME_A",
    "arn:aws:iam::ACCOUNT_NUMBER:user/USERNAME_B",
    "arn:aws:iam::ACCOUNT_NUMBER:user/USERNAME_C"
    ]
    },
    "Action": [
    "s3:*"
    ],
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME/*"
    ]
    }
    ]
    }
    ```

    ## Full access (and S3 weblogin) for specific IAM users
    **Type:** group/user
    **Note:** specifying both `arn:aws:s3:::BUCKET_NAME` and `arn:aws:s3:::BUCKET_NAME/*` under the `"Resource"` block allows the IAM user to list objects at the root level of the bucket.

    ```json
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": [
    "s3:ListAllMyBuckets"
    ],
    "Resource": [
    "arn:aws:s3:::*"
    ]
    },
    {
    "Effect": "Allow",
    "Action": [
    "s3:*"
    ],
    "Resource": [
    "arn:aws:s3:::BUCKET_NAME",
    "arn:aws:s3:::BUCKET_NAME/*"
    ]
    }
    ]
    }
    ```