Vfrdtyky

How to Identify whether particular Access Key & Secret Key has to Allow S3 Operations or not ?

The Amazon S3 SDK has the AmazonS3Client which is the gateway to S3. It has a few methods you can use to explore access rights to S3 buckets and objects, however S3 bases its access rights on resource-based policies (i.e. ACL - Access Control Lists) which tells S3 which users can access the bucket / object and how and user-based policies, which are rights granted to the user.

So, what that means is, there is no native understanding of a key pair within S3's access rights management. While you can't give the SDK a keypair and expect it to return a true/false on whether or not that keypair can access a resource, there are two ideas I can think of.

1) Design your application so instead of using the IAM role (which is the preferred means of authentication when running on EC2), your application can use whatever key pair is provided at runtime, so the user of your application would need to provide the application with the key information and your application would authenticate and then try to access the resource. If it can, great, if not, it does not have permission. This is potentially overkill, depending on your use case. You would also need to ensure the security of the key information. This would be what an S3 client would do (just google 'S3 client' and you will find several).

2) Instead of trying to determine if a particular key has permission to access an object, determine if the AWS account (username) has permission. Since the access policies are user-centric, have your application authenticate via the IAM Role (again, if the app is running on EC2) or with an IAM user (if not running on EC2) with read privileges to all of S3 and poll the objects the user wants to access, check the Grants associated with that bucket or object and notify the user accordingly. If your application needs to simply check if a user has rights to an object, and not do anything further (e.g. serve up the object, make any changes, etc.), this may be the way to go.

Some methods that you may want to explore:

public AccessControlList getObjectAcl(String bucketName, String key)

                  throws AmazonClientException, AmazonServiceException



public BucketPolicy getBucketPolicy(GetBucketPolicyRequest getBucketPolicyRequest)

                   throws AmazonClientException, AmazonServiceException



public AccessControlList getBucketAcl(GetBucketAclRequest getBucketAclRequest)

                   throws AmazonClientException, AmazonServiceException

The two get*Acl methods return an AccessControlList, which you can then use to explore the Grants that have been assigned to that ACL.

Use Passing in access and secret keys through AWS CLI
1. Instal aws-cli; docs here -> https://docs.aws.amazon.com/cli/latest/userguide/installing.html
2. Use this command

AWS_ACCESS_KEY_ID=<your_id> AWS_SECRET_ACCESS_KEY=<your_key> aws s3 cp <your_file> s3://<your_bucket>

Replace with your correct details.

cp is copy in Linux/BSD/Macs. You probably need to use copy in Windows.