S3 Restricted Folder Access

Use case

In a case you want to restrict the access of DDOE to specific folder within your S3 bucket, you can easily do that.
You can grant DDOE access to only the specific folder you want DDOE to work with, without worrying about accidental modifications or deletions in other parts of your S3 bucket.

In this article, we'll walk you through the steps to limits DDOE's access to a specific folder in your S3 bucket.

Create any type of integration

For example - AWS Cross Account integration.

Create an IAM policy

1. Log in to the AWS Management Console.

2. Go to Services and click All services. A list of services is displayed.

3. Select the IAM service from the list.

4. Click on Policies from the left navigation panel.

5. Click Create policy. The Create Policy page is displayed.

6. Select the JSON tab.

7. Define the policy document in JSON format as follows:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowBucketListAccessWithPrefix",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<DataLoopBucketName>"
            ],
            "Condition": {
                "StringEquals": {
                    "s3:prefix": "<DataLoopFolderName>/"
                }
            }
        },
        {
            "Sid": "AllowBucketGetPutDelete",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::<DataLoopBucketName>/<DataLoopFolderName>/*"
            ]
        }
    ]
}

8. Click Next to Review the policy.

9. Provide a meaningful name for the policy and an optional description.

10. Click the Create policy to finish.

• Read step-by-step guide on creating an IAM policy in AWS.

• Read step-by-step guide on condition key examples in AWS.