I often need to attach an IAM policy to a user which only let the user read the content of a specific bucket. For now, AWS does not offer a predefined policy for this, so here it is.
Replace the string bucketname with your bucket name in the following JSON.
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":[
"s3:ListBucket",
"s3:ListAllMyBuckets"
],
"Resource":"arn:aws:s3:::*"
},
{
"Effect":"Deny",
"Action":[
"s3:ListBucket"
],
"NotResource":[
"arn:aws:s3:::bucketname",
"arn:aws:s3:::bucketname/*"
]
},
{
"Effect":"Allow",
"Action":[
"s3:ListBucket",
"s3:GetObject"
],
"Resource":[
"arn:aws:s3:::bucketname",
"arn:aws:s3:::bucketname/*"
]
}
]
}