[GH-ISSUE #452] IAM user with S3 policy for access into specific folder - won't work.... #245

New issue

Closed

opened 2026-03-04 01:43:38 +03:00 by kerem · 4 comments

kerem commented

2026-03-04 01:43:38 +03:00

Owner

Originally created by @SysEngDan on GitHub (Jul 15, 2016).
Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/452

Example:

Bucket name: dans_test_bucket
Folders within bucket: /folder1/folder2/
IAM User: dans_test_user
Policy: allow dans_test_user access only into dans_test_bucket/folder1/folder2/*

Policy:

{
  "Statement": [
    {
      "Sid": "Test Policy",
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::dans_test_bucket/folder1/folder2/*",
      "Principal": {
        "AWS": [
          "arn:aws:iam::1234567890:user/dans_test_user"
        ]
      }
    }
  ]

}

How do I configure the local mount and CLI to access files in dans_test_bucket/folder1/folder2/ ?

Originally created by @SysEngDan on GitHub (Jul 15, 2016). Original GitHub issue: https://github.com/s3fs-fuse/s3fs-fuse/issues/452 Example: Bucket name: **dans_test_bucket** Folders within bucket: **/folder1/folder2/** IAM User: **dans_test_user** Policy: allow dans_test_user access only into dans_test_bucket/folder1/folder2/* Policy: ``` { "Statement": [ { "Sid": "Test Policy", "Action": "s3:*", "Effect": "Allow", "Resource": "arn:aws:s3:::dans_test_bucket/folder1/folder2/*", "Principal": { "AWS": [ "arn:aws:iam::1234567890:user/dans_test_user" ] } } ] ``` } How do I configure the local mount and CLI to access files in dans_test_bucket/folder1/folder2/ ?

kerem closed this issue

2026-03-04 01:43:38 +03:00

kerem commented

2026-03-04 01:43:39 +03:00

Author

Owner

@bencodestx commented on GitHub (Jul 18, 2016):

s3:ListBucket on arn:aws:s3:::dans_test_bucket must also be granted to the user. This applies to the entire bucket so that the IAM user would be able to list ALL objects in the entire bucket (seeing the object names of ALL objects), but would only be able to access the objects with the folder1/folder2/ prefix.

@bencodestx commented on GitHub (Jul 18, 2016): s3:ListBucket on arn:aws:s3:::dans_test_bucket must also be granted to the user. This applies to the entire bucket so that the IAM user would be able to list ALL objects in the entire bucket (seeing the object names of ALL objects), but would only be able to access the objects with the folder1/folder2/ prefix.

kerem commented

2026-03-04 01:43:39 +03:00

Author

Owner

@rodrigosrangel commented on GitHub (Oct 21, 2016):

I have the same problem reading files from a bucket, not owed by me.
The "owner" defined one folder for each of his clients (I'm one of them) and won't grant me the s3:ListBucket arguing that I can't identify all his other clients.
So I got stuck ,Created an account on AWS for testing this behavior and have no idea about how to solve it. Any ideas?

@rodrigosrangel commented on GitHub (Oct 21, 2016): I have the same problem reading files from a bucket, not owed by me. The "owner" defined one folder for each of his clients (I'm one of them) and won't grant me the s3:ListBucket arguing that I can't identify all his other clients. So I got stuck ,Created an account on AWS for testing this behavior and have no idea about how to solve it. Any ideas?

kerem commented

2026-03-04 01:43:39 +03:00

Author

Owner

@anmolnagpal commented on GitHub (Jul 8, 2017):

Check This
https://www.cloudberrylab.com/blog/how-to-give-user-access-to-an-s3-folder-with-cloudberry-explorer/

@anmolnagpal commented on GitHub (Jul 8, 2017): Check This https://www.cloudberrylab.com/blog/how-to-give-user-access-to-an-s3-folder-with-cloudberry-explorer/

kerem commented

2026-03-04 01:43:39 +03:00

Author

Owner

@ggtakec commented on GitHub (Mar 30, 2019):

We kept this issue open for a long time.
I will close this, but if the problem persists, please reopen or post a new issue.

@ggtakec commented on GitHub (Mar 30, 2019): We kept this issue open for a long time. I will close this, but if the problem persists, please reopen or post a new issue.

kerem referenced this issue

2026-03-04 01:53:51 +03:00

[PR #245] [MERGED] Elide duplicate lookups of std::map via iterators #1419