Group policies specify the access permissions for the group that the policy is attached to. There is no Principal element in the policy since it is implicit. Group policies are configured using the Tenant Manager or the API.
In this example, members of the group are only permitted to list
and access their specific folder (key prefix) in the specified
bucket.
{ "Statement": [ { "Action": "s3:*", "Effect": "Allow", "Resource": "arn:aws:s3:::*" } ] }
In this example, all members of the group have read-only access to S3 resources, unless explicitly denied by the bucket policy. For example, users in this group can list objects and read object data, metadata, and tags.
{ "Statement": [ { "Sid": "AllowGroupReadOnlyAccess", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketVersions", "s3:GetObject", "s3:GetObjectTagging", "s3:GetObjectVersion", "s3:GetObjectVersionTagging" ], "Resource": "arn:aws:s3:::*" } ] }
In this example, members of the group are only permitted to list and access their specific folder (key prefix) in the specified bucket. Note that access permissions from other group policies and the bucket policy should be considered when determining the privacy of these folders.
{ "Statement": [ { "Sid": "AllowListBucketOfASpecificUserPrefix", "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::department-bucket", "Condition": { "StringLike": { "s3:prefix": "${aws:username}/*" } } }, { "Sid": "AllowUserSpecificActionsOnlyInTheSpecificUserPrefix", "Effect": "Allow", "Action": "s3:*Object", "Resource": "arn:aws:s3:::department-bucket/${aws:username}/*" } ] }
In this example, the Deny Effect for PutOverwriteObject and DeleteObject protects the object’s data, user-defined metadata, and S3 object tagging from being deleted or modified.
{ "Statement": [ { "Effect": "Deny", "Principal": "*", "Action": [ "s3:PutOverwriteObject", "s3:DeleteObject", "s3:DeleteObjectVersion" ], "Resource": "arn:aws:s3:::wormbucket/*" }, { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::95390887230002558202:federated-group/SomeGroup" }, "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::wormbucket" }, { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::95390887230002558202:federated-group/SomeGroup" }, "Action": "s3:*", "Resource": "arn:aws:s3:::wormbucket/*" } ] }