IAM policy attached to role not working - node.js

Question

I have a node application that is invoking assumeRoleWithWebIdentity in the following manner:
var params = {
DurationSeconds: 3600,
RoleArn: "arn:aws:iam::role/my_test_role",
RoleSessionName: "session_name",
WebIdentityToken: req.body.id_token
};
sts.assumeRoleWithWebIdentity(params, function(err, data) {
//create s3 client with data.Credentials.SecretAccessKey, AccessKeyId, sessionToken
//call s3.listObjectsV2({Bucket: 'my-bucket'}).
});
No, i have a role in IAM call my_test_role. Attached to that role is a policy called my_test_policy which looks as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:GetBucketLocation"
],
"Resource": "arn:aws:s3:::*"
},
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::my_bucket",
"Condition": {"StringLike": {"s3:prefix": [
"",
"home/",
"home/BOB/*"
]}}
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::my_bucket/home/BOB",
"arn:aws:s3:::my_bucket/home/BOB/*"
]
}
]
}
In s3, I have a bucket called my_bucket, and in that bucket is the folder home. In home are a bunch of user folders:
my_bucket/home/ALICE
my_bucket/home/BOB
my_bucket/home/MARY
When my node application lists objects, it lists all the objects in home. The intention with my policy is to limit the listing to the user that has assumed the role. So if BOB has assumed the role, he should only see my_bucket/home/BOB and nothing else. I'll eventually replace the hard coded 'BOB' in the policy with ${my_oidc_url:sub}. But before I get to that step, I thought I would just hardcode "BOB" and see if that works. It does not. The assumed roles sees all of the folders. Any suggestions?

Answer 1

In your s3:ListBucket policy you have allowed the home/ folder to be listed, so of course it will list everything in there.
If you only had home/BOB/* directory, then I think you would get the desired behavior.

Answer 2

To test this situation, I did the following:
Created an Amazon S3 bucket and uploaded files.
The contents are:
2018-05-11 08:57:55 10096 foo
2018-05-11 08:57:38 10096 home/alice/foo
2018-05-11 08:57:32 10096 home/bob/foo
2018-05-11 08:57:51 10096 home/foo
2018-05-11 08:57:45 10096 home/mary/foo
Created an IAM Role called bob.
The permissions are:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ListObjects",
"Effect": "Allow",
"Action": "s3:*",
"Resource": "arn:aws:s3:::my-bucket",
"Condition": {
"StringLike": {
"s3:prefix": [
"home/bob/*"
]
}
}
},
{
"Sid": "AccessObjects",
"Effect": "Allow",
"Action": "s3:*",
"Resource": "arn:aws:s3:::my-bucket/home/bob/*"
}
]
}
(ListObjects is equivalent to ListBucket)
Assumed the bob role
Via the CLI command:
aws sts assume-role --role-arn arn:aws:iam::123456789012:role/bob --role-session-name bob
Saved the resulting credentials to a bob profile
I could then do anything in the home/bob path, but nothing in other paths:
$ aws --profile bob s3 ls s3://my-bucket/home/bob/
2018-05-11 09:16:23 10096 foo
$ aws --profile bob s3 cp foo s3://my-bucket/home/bob/foo
upload: ./foo to s3://my-bucket/home/bob/foo
$ aws --profile bob s3 cp s3://my-bucket/home/bob/foo .
download: s3://my-bucket/home/bob/foo to ./foo
$ aws --profile bob s3 ls s3://my-bucket/home/
An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied
$ aws --profile bob s3 ls s3://my-bucket/
An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied
Policy Variables
While an IAM User can be easily substituted into a policy variable, this does not seem as easy with an Assumed Role. This is because the variables will be set to:
aws:username will be undefined
aws:userid will be set to role id:caller-specified-role-name
This is not as easy as simply referencing a value of 'bob'. You'd effectively need to name the S3 path something like: AIDAJQABLZS4A3QDU576Q:bob

Answer 3

Ok, it ended up being a few things.
my node.js app wasn't using my temporary credentials, but was instead using the static ones. This was because my s3 client was initialized incorrectly after assuming the role.
My node.js app was sending an empty prefix as well as an incorrect prefix in an instance
The following policy worked for me
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowUserToSeeBucketListInTheConsole",
"Action": [
"s3:ListAllMyBuckets",
"s3:GetBucketLocation"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::*"
},
{
"Sid": "AllowRootAndHomeListingOfCompanyBucket",
"Action": "s3:ListBucket",
"Effect": "Allow",
"Resource": "arn:aws:s3:::my-bucket2"
},
{
"Sid": "DenyAllListingExpectForHomeAndUserFolders",
"Effect": "Deny",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::my-bucket2",
"Condition": {
"Null": {
"s3:prefix": "false"
},
"StringNotLike": {
"s3:prefix": [
"",
"home/",
"home/${MY_OIDC_URL:sub}/*"
]
}
}
},
{
"Sid": "AllowAllS3ActionsInUserFolder",
"Effect": "Allow",
"Action": "s3:*",
"Resource": "arn:aws:s3:::my-bucket2/home/${MY_OIDC_URL:sub}/*"
}
]
}