Console UI list bucket for readonly user

[yiwiz-sai]

For example, I create a user, I only give him "readonly" policy, no consoleadmin.
If he knows a bucket name, he can read the bucket by programming or command line, but he can not login into console UI to see what buckets he can read.

I think the better way is that a user can login into console UI to see buckets which he can access. or there is a policy "list" to support that.

[dvaldivia]

can you provide some policies to replicate this behavior? At the moment the behavior is exatly as described, the listing of buckets in the UI shows all the buckets that you have access to

[yiwiz-sai]

Hi @dvaldivia, I mean, can a policy be limited to bucket level (folder) ? for example, I create 2 buckets "abc" and "xyz", then I create a user "test", I only want to give a readonly policy for "abc" bucket to him. so when he logins into UI, he can only see the "abc" bucket, can not see "xyz" bucket.

That means "abc" is a shared bucket. I think this function is really necessary.

[Alevsk]

@yiwiz-sai it's possible, please test with a policy like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::mybucket-readonly/*"
            ]
        }
    ]
}

Then create a user and assign that policy, next time the user login to Console it will see only that bucket and the objects inside, but the user doesnt have any permissions to upload or delete objects from inside the bucket

[Alevsk]

I just tested this and its working fine, please re-open the issue if you have any more questions

[yiwiz-sai]

@Alevsk, it works! thanks !
All right, I suggest that It can do this by UI operation. for example, add a policy "list" in console UI.