AWS AmazonS3 documentation change
Summary
Added documentation for directory bucket access points including policy examples, ARN formats, and operational compatibility. Updated existing access point references to specify 'general purpose buckets' and added parallel sections for directory buckets.
Security assessment
Changes add new IAM policy configurations and access control guidance for directory bucket access points, which qualifies as security documentation. However, there's no evidence these changes address a specific security vulnerability or incident - they appear to document new features and improve existing documentation clarity.
Diff
diff --git a/AmazonS3/latest/userguide/security_iam_service-with-iam.md b/AmazonS3/latest/userguide/security_iam_service-with-iam.md index f38f76195..6bb763e20 100644 --- a/AmazonS3/latest/userguide/security_iam_service-with-iam.md +++ b/AmazonS3/latest/userguide/security_iam_service-with-iam.md @@ -160 +160 @@ For more information about requiring S3 access through CloudFront URLs, see [Res - * To view policy examples for access points, see [Configuring IAM policies for using access points](./access-points-policies.html). + * To view policy examples for access points, see [Configuring IAM policies for using access points for general purpose buckets](./access-points-policies.html). @@ -232 +232 @@ The following bucket policy grants the user ``Akua`` with account ``12345678901` -###### Bucket operations in access point policies +###### Bucket operations in policies for access points for general purpose buckets @@ -234 +234 @@ The following bucket policy grants the user ``Akua`` with account ``12345678901` -Permissions granted in an access point policy are effective only if the underlying bucket allows the same permissions. When you use S3 Access Points, you must delegate access control from the bucket to the access point or add the same permissions in the access point policies to the underlying bucket's policy. For more information, see [Configuring IAM policies for using access points](./access-points-policies.html). In access point policies, S3 policy actions for bucket operations require you to use the access point ARN for the `Resource` element in the following format. +Permissions granted in an access point for general purpose buckets policy are effective only if the underlying bucket allows the same permissions. When you use S3 Access Points, you must delegate access control from the bucket to the access point or add the same permissions in the access point policies to the underlying bucket's policy. For more information, see [Configuring IAM policies for using access points for general purpose buckets](./access-points-policies.html). In access point policies, S3 policy actions for bucket operations require you to use the access point ARN for the `Resource` element in the following format. @@ -261 +261,32 @@ The following access point policy grants the user ``Akua`` with account ``123456 -Not all bucket operations are supported by S3 Access Point. For more information, see [Access point compatibility with S3 operations](./access-points-service-api-support.html#access-points-operations-support). +Not all bucket operations are supported by access points for general purpose buckets. For more information, see [Access points for general purpose buckets compatibility with S3 operations](./access-points-service-api-support.html#access-points-operations-support). + +###### Bucket operations in policies for access points for directory buckets + +Permissions granted in an access points for directory buckets policy are effective only if the underlying bucket allows the same permissions. When you use S3 Access Points, you must delegate access control from the bucket to the access point or add the same permissions in the access point policies to the underlying bucket's policy. For more information, see [Configuring IAM policies for using access points for directory buckets](./access-points-directory-buckets-policies.html). In access point policies, S3 policy actions for bucket operations require you to use the access point ARN for the `Resource` element in the following format. + + + "Resource": "arn:aws:s3:us-west-2:123456789012:accesspoint/example-access-point--usw2-az1--xa-s3" + +The following access point policy grants the user ``Akua`` with account ``12345678901`` the `s3:ListBucket` permission to perform the [ListObjectsV2](https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html) API operation through the access point named ``example-access-point--usw2-az1--xa-s3``. This permission allows ``Akua`` to list the objects in the bucket that's associated with ``example-access-point--usw2-az1--xa-s3``. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "Allow Akua to list objects in the bucket through access point", + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::12345678901:user/Akua" + }, + "Action": [ + "s3:ListBucket" + ], + "Resource": "arn:aws:s3express:us-west-2:123456789012:accesspoint/example-access-point--usw2-az1--xa-s3" + } + ] + } + +###### Note + +Not all bucket operations are supported by access points for directory buckets. For more information, see [Access point for directory buckets compatibility](./access-points-directory-buckets-service-api-support.html). @@ -329 +360,33 @@ The following access point policy grants the user ``Akua`` with account ``123456 -Not all object operations are supported by access points. For more information, see [Access point compatibility with S3 operations](./access-points-service-api-support.html#access-points-operations-support). +Not all object operations are supported by access points. For more information, see [Access points for general purpose buckets compatibility with S3 operations](./access-points-service-api-support.html#access-points-operations-support). + +###### Object operations in policies for access points for directory buckets + +When you use access points for directory buckets to control access to object operations, you can use access point policies. When you use access point policies, S3 policy actions for object operations require you to use the access point ARN for the `Resource` element in the following format: `arn:aws:s3:`region`:`account-id`:accesspoint/`access-point-name`/object/`resource``. For object operations that use access points, you must include the `/object/` value after the whole access point ARN in the `Resource` element. Here are some examples. + + + "Resource": "arn:aws:s3express:us-west-2:123456789012:accesspoint/example-access-point--usw2-az1--xa-s3/object/*" + + + "Resource": "arn:aws:s3express:us-west-2:123456789012:accesspoint/example-access-point--usw2-az1--xa-s3/object/prefix/*" + +The following access point policy grants the user ``Akua`` with account ``12345678901`` the `s3:GetObject` permission. This permission allows ``Akua`` to perform the [GetObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html) API operation through the access point named ``example-access-point--usw2-az1--xa-s3`` on all objects in the bucket that's associated with the access point. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "Allow Akua to get objects through access point", + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::12345678901:user/Akua" + }, + "Action": "s3express:CreateSession","s3:GetObject" + "Resource": "arn:aws:s3:us-west-2:123456789012:accesspoint/example-access-point--usw2-az1--xa-s3/object/*" + } + ] + } + +###### Note + +Not all object operations are supported by access points for directory buckets. For more information, see [Access point compatibility with S3 operations](./access-points-directory-buckets-service-api-support.html#access-points-directory-buckets-operations-support). @@ -331 +394 @@ Not all object operations are supported by access points. For more information, -### Access point operations +### Access point for general purpose bucket operations @@ -355 +418,62 @@ The following IAM identity-based policy grants the `s3:GetAccessPointPolicy` per -When you use Access Points, to control access to bucket operations, see Bucket operations in access point policies; to control access to object operations, see Object operations in access point policies. For more information about how to configure access point policies, see [Configuring IAM policies for using access points](./access-points-policies.html). +When you use Access Points, to control access to bucket operations, see Bucket operations in policies for access points for general purpose buckets; to control access to object operations, see Object operations in access point policies. For more information about how to configure access point policies, see [Configuring IAM policies for using access points for general purpose buckets](./access-points-policies.html). + +### Access point for directory buckets operations + +Access point for directory buckets operations are S3 API operations that operate on the `accesspoint` resource type. For example, `CreateAccessPoint`, `DeleteAccessPoint`, and `GetAccessPointPolicy`. S3 policy actions for access point operations can only be used in IAM identity-based policies, not in bucket policies or access point policies. Access points for directory buckets operations require the `Resource` element to be the access point ARN in the following example format. + + + "Resource": "arn:aws:s3:us-west-2:123456789012:accesspoint/example-access-point--usw2-az1--xa-s3" + +The following IAM identity-based policy grants the `s3express:GetAccessPointPolicy` permission to perform the [GetAccessPointPolicy](https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicy.html) API operation on the access point named ``example-access-point--usw2-az1--xa-s3``. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "Grant permission to retrieve the access point policy of access point example-access-point--usw2-az1--xa-s3", + "Effect": "Allow", + "Action": [ + "s3express:CreateSession","s3express:GetAccessPointPolicy" + ], + "Resource": "arn:aws:s3:*:123456789012:accesspoint/example-access-point--usw2-az1--xa-s3" + } + ] + } + +The following IAM identity-based policy grants the `s3express:CreateAccessPoint` permission to create an access points for directory buckets. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "Grant CreateAccessPoint.", + "Principal": "*", + "Action": "s3express:CreateSession", + "s3express:CreateAccessPoint""Effect": "Allow", + "Resource": "*" + } + ] + } + + +The following IAM identity-based policy grants the `s3express:PutAccessPointScope` permission to create access point scope for access points for directory buckets. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "Grant PutAccessPointScope", + "Principal": "*", + "Action": "s3express:CreateSession", + "s3express:CreateAccessPoint", + "S3Express:PutAccessPointScope""Effect": "Allow", + "Resource": "*", + } + ] + } + + +When you use access points for directory buckets to control access to bucket operations, see Bucket operations in policies for access points for directory buckets; to control access to object operations, see Object operations in policies for access points for directory buckets. For more information about how to configure access points for directory buckets policies, see [Configuring IAM policies for using access points for directory buckets](./access-points-directory-buckets-policies.html). @@ -424 +548 @@ The following IAM identity-based policy grants the `s3:GetAccountPublicAccessBlo - * To view examples of Amazon S3 resource-based policies, see [Bucket policies for Amazon S3](./bucket-policies.html) and [Configuring IAM policies for using access points](./access-points-policies.html). + * To view examples of Amazon S3 resource-based policies, see [Bucket policies for Amazon S3](./bucket-policies.html) and [Configuring IAM policies for using access points for general purpose buckets](./access-points-policies.html). @@ -487 +611 @@ At runtime, when the policy is evaluated, the variable `${aws:username}` in the - * To view examples of Amazon S3 resource-based policies, see [Bucket policies for Amazon S3](./bucket-policies.html) and [Configuring IAM policies for using access points](./access-points-policies.html). + * To view examples of Amazon S3 resource-based policies, see [Bucket policies for Amazon S3](./bucket-policies.html) and [Configuring IAM policies for using access points for general purpose buckets](./access-points-policies.html). @@ -543 +667 @@ In the example, the `Condition` block specifies the `StringEquals` condition tha - * To view examples of Amazon S3 resource-based policies, see [Bucket policies for Amazon S3](./bucket-policies.html) and [Configuring IAM policies for using access points](./access-points-policies.html). + * To view examples of Amazon S3 resource-based policies, see [Bucket policies for Amazon S3](./bucket-policies.html) and [Configuring IAM policies for using access points for general purpose buckets](./access-points-policies.html).