Search code examples
amazon-web-servicesamazon-s3aws-policiesaws-permissions

s3 bucket policy to access object url

What is s3 bucket policy permission to provide an IAM user to access object url which is basically an HTTPs url for the object that i have uploaded to S3 bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucket",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::bucket"
        },
        {
            "Sid": "GetObject",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::bucket/*"
        }
    ]
}

With above policy i can download the object into my local , but i cant access it with object url which includes Https link. If i keep the s3 bucket full public , only then i can have the https access to the object url.

I dont want to provide full public access and how to provide access to this with bucket policy?

Solution

  • You can get https url by generating s3 pre-signed urls for the objects. This will allow for temporary access using the urls generated.

    Other than that, a common choice is to share your s3 objects with an outside world without making your bucket public using CloudFront as explained in: