AWS IAM - Can you use multiple wildcards (*) in a value

drzaus picture drzaus · Mar 21, 2014 · Viewed 20.6k times · Source

In all of the IAM Policy examples, they mention using wildcards (*) as placeholders for "stuff". However, the examples always use them at the end, and/or only demonstrate with one wildcard (e.g. to list everything in folder "xyz" with .../xyz/*).

I can't find anything definitive regarding the use of multiple wildcards, for example to match anything in subfolders across multiple buckets:

arn:aws:s3:::mynamespace-property*/logs/*

to allow something to see any log files across a "production" (mynamespace-property-prod) and "sandbox" (mynamespace-property-sand) bucket.

Answer

drzaus picture drzaus · Mar 21, 2014

Not sure, but "all of a sudden" (you know what I'm talking about) it's working in the policy simulator with:

  • Policy 1: "allow specific S3 permissions on any bucket" (e.g. an editor role)
  • Policy 2: "deny all S3 actions unless in a user's folder across buckets" (i.e. can only see their files)

Where 'Policy 2' is:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ExplicitlyDenyAnythingExceptOwnNamedFolder",
            "Action": [
                "s3:*"
            ],
            "Effect": "Deny",
            "NotResource": [
                "arn:aws:s3:::mynamespace-property*/subfolder/${aws:username}/*"
            ]
        }
    ]
}

As a sidenote, be aware that arn:aws:s3:::mynamespace-property*/${aws:username}/* (no explicit subfolder) will match both with and without "intervening" subfolders:

  • arn:aws:s3:::mynamespace-property-suffix/subfolder/theuser/files..."
  • arn:aws:s3:::mynamespace-property-suffix/theuser/files..."