Question
A company wants to deny a specific federated user named Bob access to an Amazon S3 bucket named DOC-EXAMPLE-BUCKET. The company wants to meet this requirement by using a bucket policy. The company also needs to ensure that this bucket policy affects Bob's S3 permissions only. Any other permissions that Bob has must remain intact.
Which policy should the company use to meet these requirements?
- A. {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":{"Federated":"arn:aws:iam::123456789012:saml-provider/ExampleSAMLProvider"},"Action":"s3:*","Resource":["arn:aws:s3:::DOC-EXAMPLE-BUCKET","arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"],"Condition":{"StringEquals":{"aws:username":"Bob"}}}]}
- B. {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":{"AWS":"arn:aws:sts::123456789012:federated-user/Bob"},"Action":"s3:*","Resource":["arn:aws:s3:::DOC-EXAMPLE-BUCKET","arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"]}]} Correct
- C. {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":{"Federated":"arn:aws:iam::123456789012:saml-provider/ExampleSAMLProvider"},"Action":"s3:*","Resource":["arn:aws:s3:::DOC-EXAMPLE-BUCKET","arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"]}]}
- D. {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":{"Federated":"arn:aws:iam::123456789012:saml-provider/ExampleSAMLProvider"},"Action":"s3:*","Resource":["arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"],"Condition":{"StringEquals":{"aws:username":"Bob"}}}]}
Explanation
Option B is correct. A federated user session created with GetFederationToken is identified in a resource-based policy by the principal ARN arn:aws:sts::<account-ID>:federated-user/<user-name>. A Deny statement in the bucket policy for that principal on s3:* for both the bucket and its objects blocks Bob from DOC-EXAMPLE-BUCKET while leaving every other permission he has unchanged, because the bucket policy only governs this bucket. Options A, C and D use a SAML provider in a Federated principal, which is supported only in IAM role trust policies, not in bucket policies; in addition, C would target every user of that provider, D covers only objects and not the bucket itself, and the aws:username key is available only for IAM users, not federated sessions.
