title: AWS S3 deny all access except for 1 user - bucket policy
body: <p>I have set up a bucket in AWS S3.  I granted access to the bucket for my IAM user with an ALLOW policy (Using the Bucket Policy Editor).  I was able to save files to the bucket with the user.  I have been working with the bucket for media serving before, so it seems the default action is to give public permission to view the files (images), which is fine for most web sites.</p>
  
  <p>In my new project I want to be able to access the S3 bucket with an IAM user but want to deny all other access.  No public read access, no access whatsoever besides the IAM user who should have full access save/delete whatever.</p>
  
  <p>What seems like I should do, I was reading about <a href="https://blogs.aws.amazon.com/security/post/Tx14BCDOC9WO5R4/How-to-Create-a-Policy-That-Whitelists-Access-to-Sensitive-Amazon-S3-Buckets" rel="nofollow">here</a>.  It says to create a <code>Deny</code> policy using the <code>NotPrincipal</code> attribute, and that way it will still allow that user, but deny everyone else.  For good measure I also added an <code>Allow</code> policy just for the user I want:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Id": "Policy**********",
      "Statement": [
          {
              "Sid": "Stmt**********",
              "Effect": "Deny",
              "NotPrincipal": {
                  "AWS": "arn:aws:iam::*********:user/my_user"
              },
              "Action": "s3:*",
              "Resource": "arn:aws:s3:::my_bucket/*"
          },
          {
              "Sid": "Stmt*************",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::**********:user/my_user"
              },
              "Action": "s3:*",
              "Resource": "arn:aws:s3:::my_bucket/*"
          }
      ]
  }
  </code></pre>
  
  <p>But this is denying access to everyone even <code>my_user</code>.  Again I can confirm that I had access when I just used the <code>Allow</code> portion of the policy above, but then the public also has read access, which I am trying to turn off.</p>
  
  <p>How can I set up my bucket policy to give full access to only the unique IAM user and deny all access to any other user?</p>
  
  <p>Thanks.</p>