Grant list permissions to all S3 buckets without seeing the content

DevOps AWS
#1

Hi! Is there a way to grant list permissions to all S3 buckets w/o seeing the content of them?

#2

List object names is ListBucket getting the content of objects is GetObject

#3

So if I grant only ListBucket should work, right?

#4

That’s right, and remember the Resource is the bucket, without the key prefix

#5

I’ll testing right now. Thanks!

#6

Np, that one is a little weird because it’s one of the rare places the IAM permission name (ListBuckets) doesn’t align with the API method name (ListObjectsV2)

#7

It sounds like you are actually looking for ListAllMyBuckets https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html

#8

ListBucket is the contents of a bucket

#9

Oh, yes I could have been confused by the wording. You are looking to see a list of all S3 buckets in the account? Or to see the names of the objects inside the buckets?

#10

List to see all buckets but not the content of them if possible

#11

Ah, sorry, then you want what conzy said

#12

Can you please help me why is this happening?

#13

You are almost there……

#14

The link I posted above shows what resources are valid for a given action

#15

If you are using ListAllMyBuckets the resource must be *

#16

And if you include ListBucket like you have then principals will be able to list bucket contents

#17

Which is what you didnt want

#18

Thank you! I reviewed and remove ListBucket permission and used ListAllMyBuckets

#19 
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:GetBucketPolicy",
                "s3:GetBucketPolicyStatus",
                "s3:ListAllMyBuckets"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::*"
        }
    ]
}```
#20

I used aws cli and I was able to list the buckets and their policies but couldn’t get the content of the buckets