Replace wildcard data access with a scoped allow, preserve an explicit deny for insecure transport, and test evaluation outcomes.
Politique IAM (JSON)
Objectifs
- Remove broad `s3:*` and global resource access.
- Allow only GetObject and PutObject on one prefix.
- Keep an explicit deny when secure transport is false.
- Pass the built-in allow/deny simulations.
Indices
Voir la solution
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ScopedProjectAccess",
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:PutObject"],
"Resource": "arn:aws:s3:::research-results/project-a/*"
},
{
"Sid": "DenyInsecureTransport",
"Effect": "Deny",
"Action": "s3:*",
"Resource": "*",
"Condition": {
"Bool": { "aws:SecureTransport": "false" }
}
}
]
}