20.5.1 Creating an IAM Policy to Access an Amazon S3 Bucket

Use the AWS Management Console to create an IAM policy to access an Amazon S3 bucket.

This task requires the following:

• Access to AWS Management Console.
• The name of the Amazon S3 bucket you want to grant access to.

Do the following to create an IAM policy:

1. Open the AWS Management Console and sign in with your credentials.
2. In the AWS Management Console home page, click Services, and click Security, Identity, & Compliance, and then click IAM.
3. In the navigation pane of the Console, under Access management, click Policies, and then click Create policy.
   It opens the Specify permissions page.
4. In the Specify permissions page, in the Policy editor section, click JSON, and enter the following Amazon S3 permissions as per the feature you use. For more information on policies, see Generate policies.
   • For bulk ingest:

     {    
         "Version": "2012-10-17",    
         "Statement": [        
             {            
                 "Effect": "Allow",            
                 "Action": [                
                     "s3:GetObject"            
                 ],            
                 "Resource": [                
                     "arn:aws:s3:::<AmazonS3BucketName>/*"            
                 ]        
             }   
         ]
     }

   • For data import:

     {    
         "Version": "2012-10-17",    
         "Statement": [        
             {            
                 "Effect": "Allow",            
                 "Action": [                
                     "s3:GetObject"            
                 ],            
                 "Resource": [                
                     "arn:aws:s3:::<AmazonS3BucketName>/*"            
                 ]        
             },        
             {            
                 "Effect": "Allow",            
                 "Action": [                
                     "s3:ListBucket"           
                 ],            
                 "Resource": [                
                     "arn:aws:s3:::<AmazonS3BucketName>"            
                 ]        
             }    
         ]
     }

   • If the objects in the Amazon S3 bucket are encrypted with a customer-managed KMS key, add the following permission for the keys used for encrypting the objects:

     {    
         "Version": "2012-10-17",    
         "Statement": [        
             {            
                 "Effect": "Allow",            
                 "Action": [                
                     "kms:Decrypt"          
                 ],            
                 "Resource": [                
                     "<KmsKeyArn>"            
                 ]        
             }
         ]
     }

     See Using IAM policies with AWS KMS.
   • For Lakehouse:

     {    
         "Version": "2012-10-17",    
         "Statement": [        
             {            
                 "Effect": "Allow",            
                 "Action": [                
                     "s3:GetObject"            
                 ],            
                 "Resource": [                
                     "arn:aws:s3:::<AmazonS3BucketName>/*"            
                 ]        
             },        
             {            
                 "Effect": "Allow",            
                 "Action": [                
                     "s3:ListBucket"           
                 ],            
                 "Resource": [                
                     "arn:aws:s3:::<AmazonS3BucketName>"            
                 ]        
             }    
         ]
     }

5. Resolve any warnings or errors generated during permissions validation, and then click Next.
6. In the Review and create page, in the Policy details section, enter the following:
   • Policy name: Specify a name to identify this policy.
   • Description: (Optional) Specify a description of the policy.
7. Click Create policy.

Parent topic: Manage AWS Access