How to set amazon S3 bucket policy to private to everyone except admin?

I've got a bucket where i've accidently uploaded thousands of files with ACL to :public_read I would like all files to be unavailable except with a generated access URL.

I tried to create a bucket policy with deny all to everyone, and allow all to me.

It doesnt work and all files are forbidden even with a generated access URL :

http://s3.amazonaws.com/myBucket/myFile.pdf?AWSAccessKeyId=AKIAIZB2XTOJ6KYB5SCA&Expires=1331137308&Signature=zRfPOj4XFBrXhyqDZ5DpwJqsWs0%3D

{
    "Version": "2008-10-17",
    "Id": "Policy1331136935471",
    "Statement": [
        {
            "Sid": "Stmt1331136294179",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::myBucket/*"
        },
        {
            "Sid": "Stmt1331136364169",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::6527...3775:root"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::myBucket/*"
        }
    ]
}

UPDATE :
i found reference to the default deny in the doc but the AWS Policy Generator has only 2 values "Allow" and "Deny" does anyone has the syntax for default deny ?

Thanks for your help

amazon-s3

Edit Report

Ok, so as far as I understand if I only set allow to me then it should be deny to everyone else by default.

I tried to set that bucket policy but my files are still downloadable : just remove the access key id from the URL, like : http://s3.amazonaws.com/myBucket/myFile.pdf

My files ACL are still set as :public-Read so it seems that indeed I have a conflict between bucket policy and individual files ACL.

I gave up making all files private through bucket policy, if anybody ever needs to make a large number of files private inside a S3 bucket, here is the rake task I finally wrote :

  desc "Make all objects in S3 private"
  task :make_private  => :environment do
    require 'aws/s3'

    bucket_name = 'yourBucket'
    marker = ""

    AWS::S3::Base.establish_connection!(
      :access_key_id => "yourKey",
      :secret_access_key => "yourSecret"
    )

    #create the read-only by me policy
    owner_grant = ACL::Grant.new
    grantee = ACL::Grantee.new
    owner_grant.grantee = grantee
    owner_grant.permission = 'READ'
    grantee.type = "CanonicalUser"
    grantee.id = 'yourID'
    grantee.display_name = "yourName"


    # Iterate over all files inside bucket and apply the policy to each files
    loop do
      objects = Bucket.objects(bucket_name, :marker=>marker, :max_keys=>1000)

      marker = objects.last.key
      puts "new marker is \"#{marker}\""

      objects.each do |obj|
          policy = S3Object.acl(obj.key, bucket_name)
          policy.grants = [owner_grant]
          S3Object.acl(obj.key, bucket_name, policy)
      end
    end
  end

P.S: For info I have tried to change all files ACL using Firefox S3 Organizer or bucket explorer, none of them works if you have several hundreds of thousands of files, they just freeze.

answered 2012-03-08T06:43:59.297

How to set amazon S3 bucket policy to private to everyone except admin?

1 Answer

Your Answer