title: Bucket policy to whitelist a specific IAM role
body: <p>I have a bucket policy which looks like this:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::test-bucket/*"
          },
          {
              "Effect": "Deny",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::test-bucket/*",
              "Condition": {
                  "StringEquals": {
                      "s3:ExistingObjectTag/status": "INFECTED"
                  },
                  "StringNotLike": {
                      "aws:SourceArn": "arn:aws:sts::1234567890:assumed-role/ecs_task_role/*"
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>What I want is something like this:</p>
  
  <p>If the s3 object has a tag with the key-value <code>status=INFECTED</code>, then restrict access to the public, unless you are using this iam role <code>arn:aws:iam::1234567890:role/ecs_task_role</code>. So any system(container here) which assumes this iam role should be able to access the bucket contents regardless of what tag the objects in it has.</p>
  
  <p>I've seen that my ecs tasks assume this role and its role arn then looks something like this: <code>arn:aws:sts::1234567890:assumed-role/ecs_task_role/e7f2364b-c93d-4228-9259-1a59bdf2d201</code>. </p>
  
  <p>So I've used the wildcard <code>StringNotLike</code> operator to whitelist the requests coming from my ecs tasks.</p>
  
  <p>But for some reason this doesn't work. My ecs tasks are getting 403 access denied's when trying to download objects from the bucket with the tag <code>status: INFECTED</code>. What am I missing here? And more importantly, What do I need to change to make this access control logic work?</p>
  
  <p>Thanks in advance! </p>