Amazon S3 Access Control List retrieval

Use Amazon S3 Access Control Retrieval to identify which users can access S3 buckets and objects based on bucket policies and IAM Identity Center permissions

Permissions

Ensure that the AWS credentials used for the S3 connection have the following IAM permissions:

  • identitystore:ListUsers
  • identitystore:DescribeUser
  • identitystore:ListGroups
  • identitystore:DescribeGroup
  • identitystore:ListGroupMemberships
  • sso:ListInstances
  • sso:ListPermissionSets
  • sso:DescribePermissionSet
  • sso:ListAccountAssignments
  • iam:ListRoles
  • iam:GetRole
  • iam:GetRolePolicy
  • iam:ListAttachedRolePolicies
  • iam:GetPolicy
  • iam:GetPolicyVersion
  • iam:ListRolePolicies
  • s3:*
  • s3-object-lambda:*

Prerequisites

Before you retrieve Amazon S3 access permissions, ensure that:

  • Integrate AWS IAM Identity Center with a SAML-based identity provider, such as Microsoft Entra ID For more information, see Configure SAML and SCIM with Microsoft Entra ID and IAM Identity Center
  • Assign the ReadOnlyAccess permission set to all users created through the SAML integration.
  • Configure your S3 bucket policies to define user principals by using the SAML unique ID in the following AWS STS assumed-role format: arn:aws:sts::<AccountID>:assumed-role/<RoleName>/<SAML-unique-id>

Access Control Retrieval methods

Use Amazon S3 Access Control Retrieval to identify who can access your S3 buckets and objects based on configured policies and permissions.

View access defined in S3 bucket policies

Retrieve access permissions that are granted or denied through S3 bucket policies. The retrieval process supports IAM Identity Center users that are referenced as AWS STS assumed-role principals. You can retrieve access information for:

  • Specific S3 buckets.
  • Specific S3 objects.
  • Resources specified by wildcard characters.

The retrieval process supports both Allow and Deny policy statements.

View access granted by permission sets

1klyt7Retrieve access permissions that are assigned through AWS IAM Identity Center permission sets. The retrieval process analyzes permission set assignments and resolves the users who are associated with those assignments.

Limitations

  • Only IAM Identity Center users are supported. Group-based permissions are not supported.
  • Complex policy conditions have limited support.
  • Legacy Amazon S3 Access Control Lists (ACLs) are not supported.