title: Amazon S3 access policy for a typical web application with RBAC
body: <p>Evaluating S3 for storage needs of a node.js web application with <code>Role Based Access Control (RBAC)</code>. </p>
  
  <p>There are two scenarios for accessing S3:</p>
  
  <p><em>Scenario 1:</em> An authenticated user logs in to our application. The application allows the user to perform CRUD operations to resources (which are part of the users' profile) persisted on S3. </p>
  
  <p><em>Scenario 2:</em> Any user can access (read-only, of course) other user's public profile (which will contain resources served from S3). The concept is not unlike linkedin or other applications where a user's public profile may be visible to 'all' users.</p>
  
  <p>This is what I tried:</p>
  
  <ol>
  <li><p>Created two groups, <code>GROUP_RW</code> with <code>AmazonS3FullAccess</code> and <code>GROUP_R</code> with <code>AmazonS3ReadOnlyAccess</code></p></li>
  <li><p>Created users under both these groups</p></li>
  <li><p>For 'Scenario 1' access S3 as <code>GROUP_RW</code> user</p></li>
  <li><p>For 'Scenario 2' access S3 as <code>GROUP_R</code> user</p></li>
  </ol>
  
  <p>However, under <code>Bucket | Permissions | Grantee</code>, I do not see the users created for <code>GROUP_RW</code> and <code>GROUP_R</code>.</p>
  
  <p>How would one go about enforcing this kind of a policy?</p>