title: Cognito Role and AWS S3 Bucket policy for mobile and web access
body: <p>Our goal is to create S3 bucket and IAM role policies that will only allow S3 access to our logged in users.</p>
  
  <p>We are hosting private files on an S3 bucket that will be accessed from both a web and mobile app. We are attempting to add a layer of security with Amazon Cognito, using an unauthenticated role, so that any users signed into our application can access the S3 bucket.</p>
  
  <p>Using the AWS-SDK for JS and following the basic <code>AWS.config.credentials</code> setup, we can see 1 identity accessed and the number of syncs in our Amazon Cognito Identity Dashboard. Since we seem to be connecting to the IdentityPool, I'm thinking that our policies may need some tweaking so that logged in users that have the unauthenticated Cognito role can access the S3 bucket.</p>
  
  <p>IAM Role policy for Cognito_IdentityPoolUnauth_Role</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "SID_NUMBER",
          "Effect": "Allow",
          "Action": [
              "s3:*"
          ],
          "Resource": [
              "arn:aws:s3:::OUR_BUCKET_NAME/*"
          ]
      }
    ]
  }
  </code></pre>
  
  <p>S3 BUCKET POLICY</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Id": "http referer policy example",
  "Statement": [
      {
          "Sid": "",
          "Effect": "Allow",
          "Principal": {
              "AWS": "arn:aws:iam::IAM_NUMBER:role/Cognito_IdentityPoolUnauth_Role"
          },
          "Action": "s3:*",
          "Resource": "arn:aws:s3:::OUR_BUCKET_NAME/*"
      }
    ]
  }
  </code></pre>