"read" permissions for buckets can be simplified
s3:GetObject and s3:ListBucket are the only things we probably need.
(Also splits things into per-object and per-bucket statements, since
`s3:GetObject` cannot apply to buckets, and `s3:ListBucket` cannot
apply to objects.)
@@ -55,44 +55,14 @@ class Bucket(aws.s3.Bucket):
"Statement": [
{
"Effect": "Allow",
- "Action": [
- "s3:GetBucketAcl",
- "s3:GetBucketCORS",
- "s3:GetBucketLocation",
- "s3:GetBucketLogging",
- "s3:GetBucketNotification",
- "s3:GetBucketObjectLockConfiguration",
- "s3:GetBucketOwnershipControls",
- "s3:GetBucketPolicy",
- "s3:GetBucketPolicyStatus",
- "s3:GetBucketPublicAccessBlock",
- "s3:GetBucketRequestPayment",
- "s3:GetBucketTagging",
- "s3:GetBucketVersioning",
- "s3:GetBucketWebsite",
- "s3:GetObject",
- "s3:GetObjectAcl",
- "s3:GetObjectLegalHold",
- "s3:GetObjectRetention",
- "s3:GetObjectTagging",
- "s3:GetObjectTorrent",
- "s3:GetObjectVersion",
- "s3:GetObjectVersionAcl",
- "s3:GetObjectVersionForReplication",
- "s3:GetObjectVersionTagging",
- "s3:GetObjectVersionTorrent",
- "s3:ListAccessPoints",
- "s3:ListAccessPointsForObjectLambda",
- "s3:ListAllMyBuckets",
- "s3:ListBucket",
- "s3:ListBucketMultipartUploads",
- "s3:ListBucketVersions",
- "s3:ListJobs",
- "s3:ListMultipartUploadParts",
- "s3:ListStorageLensConfigurations",
- ],
- "Resource": [bucket_arn, f"{bucket_arn}/*"],
- }
+ "Action": "s3:GetObject",
+ "Resource": f"{bucket_arn}/*",
+ },
+ {
+ "Effect": "Allow",
+ "Action": "s3:ListBucket",
+ "Resource": bucket_arn,
+ },
],
}
)
