AWS IAM - Can you use multiple wildcards (*) in a value

StackOverflow https://stackoverflow.com/questions/22561731

Question

In all of the IAM Policy examples, they mention using wildcards (*) as placeholders for "stuff". However, the examples always use them at the end, and/or only demonstrate with one wildcard (e.g. to list everything in folder "xyz" with .../xyz/*).

I can't find anything definitive regarding the use of multiple wildcards, for example to match anything in subfolders across multiple buckets:

arn:aws:s3:::mynamespace-property*/logs/*

to allow something to see any log files across a "production" (mynamespace-property-prod) and "sandbox" (mynamespace-property-sand) bucket.

Was it helpful?

Solution

Not sure, but "all of a sudden" (you know what I'm talking about) it's working in the policy simulator with:

  • Policy 1: "allow specific S3 permissions on any bucket" (e.g. an editor role)
  • Policy 2: "deny all S3 actions unless in a user's folder across buckets" (i.e. can only see their files)

Where 'Policy 2' is:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ExplicitlyDenyAnythingExceptOwnNamedFolder",
            "Action": [
                "s3:*"
            ],
            "Effect": "Deny",
            "NotResource": [
                "arn:aws:s3:::mynamespace-property*/subfolder/${aws:username}/*"
            ]
        }
    ]
}

As a sidenote, be aware that arn:aws:s3:::mynamespace-property*/${aws:username}/* (no explicit subfolder) will match both with and without "intervening" subfolders:

  • arn:aws:s3:::mynamespace-property-suffix/subfolder/theuser/files..."
  • arn:aws:s3:::mynamespace-property-suffix/theuser/files..."

OTHER TIPS

Yes, It will work

From the documentation:

You can use wildcards as part of the resource ARN. You can use wildcard characters (* and ?) within ARN segments (the parts separated by colons) to represent any combination of characters with an askterisk (*) and any single character with a question mark (?). You can use multiple * or ? characters in each segment.

For those questioning the meaning of the single *. Do not interpret that as spanning multiple segments but rather that is has special meaning of ALL RESOURCES.

Worth noting you you cannot use a wildcard to match part of a principal name or ARN (if you are working with a resource based policy).

The ARN Format is composed by segments (like partition, service, regions, ...):

arn:partition:service:region:account-id:resource-id
arn:partition:service:region:account-id:resource-type/resource-id
arn:partition:service:region:account-id:resource-type:resource-id

the say:

You can use multiple * or ? characters in each segment, but a wildcard cannot span segments.

I interpret that like you can use many wildcards, but the ones you use in a segment (delimited by :) doesn't affect the other segments. So the answer is yes.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top