Design the read-only S3 bucket policy about s3-credentials HOT 5 CLOSED

There are 50 s3 read and 10 s3 list permissions listed here: https://iam-definitions.vercel.app/iam/privileges?service__exact=s3&_sort=rowid&_facet=access_level&access_level__in=Read,List&_nocol=resource_types&_nocol=access_level

https://iam-definitions.vercel.app/iam?sql=select+%27-+%5Bs3%3A%27+%7C%7C+privilege+%7C%7C+%27%5D%28%27+%7C%7C+api_documentation_link+%7C%7C+%27%29%27+as+name+from+privileges+where+%22access_level%22+in+%28%27Read%27%2C+%27List%27%29+and+%22service%22+%3D+%3Ap1&p0=Read&p1=s3

• s3:DescribeJob
• s3:DescribeMultiRegionAccessPointOperation
• s3:GetAccelerateConfiguration
• s3:GetAccessPoint
• s3:GetAccessPointConfigurationForObjectLambda
• s3:GetAccessPointForObjectLambda
• s3:GetAccessPointPolicy
• s3:GetAccessPointPolicyForObjectLambda
• s3:GetAccessPointPolicyStatus
• s3:GetAccessPointPolicyStatusForObjectLambda
• s3:GetAccountPublicAccessBlock
• s3:GetAnalyticsConfiguration
• s3:GetBucketAcl
• s3:GetBucketCORS
• s3:GetBucketLocation
• s3:GetBucketLogging
• s3:GetBucketNotification
• s3:GetBucketObjectLockConfiguration
• s3:GetBucketOwnershipControls
• s3:GetBucketPolicy
• s3:GetBucketPolicyStatus
• s3:GetBucketPublicAccessBlock
• s3:GetBucketRequestPayment
• s3:GetBucketTagging
• s3:GetBucketVersioning
• s3:GetBucketWebsite
• s3:GetEncryptionConfiguration
• s3:GetIntelligentTieringConfiguration
• s3:GetInventoryConfiguration
• s3:GetJobTagging
• s3:GetLifecycleConfiguration
• s3:GetMetricsConfiguration
• s3:GetMultiRegionAccessPoint
• s3:GetMultiRegionAccessPointPolicy
• s3:GetMultiRegionAccessPointPolicyStatus
• s3:GetObject
• s3:GetObjectAcl
• s3:GetObjectLegalHold
• s3:GetObjectRetention
• s3:GetObjectTagging
• s3:GetObjectTorrent
• s3:GetObjectVersion
• s3:GetObjectVersionAcl
• s3:GetObjectVersionForReplication
• s3:GetObjectVersionTagging
• s3:GetObjectVersionTorrent
• s3:GetReplicationConfiguration
• s3:GetStorageLensConfiguration
• s3:GetStorageLensConfigurationTagging
• s3:GetStorageLensDashboard
• s3:ListAccessPoints
• s3:ListAccessPointsForObjectLambda
• s3:ListAllMyBuckets
• s3:ListBucket
• s3:ListBucketMultipartUploads
• s3:ListBucketVersions
• s3:ListJobs
• s3:ListMultiRegionAccessPoints
• s3:ListMultipartUploadParts
• s3:ListStorageLensConfigurations

from s3-credentials.

AWS are dropping Torrent support: https://github.com/awsdocs/amazon-s3-userguide/blob/0d1759880ccb1818ab0f14129ba1321c519d2ac1/doc_source/S3Torrent.md - so I won't include GetObjectTorrent or GetObjectVersionTorrent.

from s3-credentials.

I'm going with:

s3:GetObject
s3:GetObjectAcl
s3:GetObjectLegalHold
s3:GetObjectRetention
s3:GetObjectTagging

And from the List family:

s3:ListBucket

I decided NOT to include the "get version" ones:

s3:GetObjectVersion
s3:GetObjectVersionAcl
s3:GetObjectVersionForReplication
s3:GetObjectVersionTagging
s3:ListBucketVersions

I'm not including these because it feels like it would be a surprise if you said "this client has read-only permissions" and the client could then retrieve information about previous versions of objects in the bucket - when you updated them you may have done so to remove information that you didn't want visible, for example.

from s3-credentials.

Also not including the ones relating to multi-part uploads:

s3:ListBucketMultipartUploads
s3:ListMultipartUploadParts

Those seem like they should be reserved for clients that are writing to the bucket and may need to continue an upload.

from s3-credentials.

I'm going to add GetBucketLocation too, see #15 (comment)

from s3-credentials.