S3 Access Point IAM Policy Matcher

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 15 mins

TL;DR

• What broke: Your S3 Access Point policy and the IAM role policy are evaluated as a logical AND by AWS — if either denies or omits the action/principal, the request dies with AccessDenied. The delegating bucket policy also must explicitly grant the Access Point authority to serve requests.
• How to fix it: Align the Access Point resource policy principal to the exact IAM role ARN, scope the bucket policy to delegate via s3:DataAccessPointArn, and ensure the IAM role's identity policy grants s3:* on the Access Point ARN — not the bucket ARN.
• Call to action: Use the Client-Side Sandbox above to paste both policies — it will auto-diff the principal and resource ARN mismatches without sending your ARNs anywhere.

An error occurred (AccessDenied) when calling the GetObject operation:
  User: arn:aws:sts::123456789012:assumed-role/DataPipelineRole/session
  is not authorized to perform: s3:GetObject
  on resource: arn:aws:s3:us-east-1:123456789012:accesspoint/my-access-point/object/data/file.parquet
  because no resource-based policy allows the s3:GetObject action

How to Fix It (The Solution)

Root Cause Checklist

Before touching policies, confirm the actual mismatch:

# Verify the Access Point ARN format — region is NOT optional
aws s3control get-access-point \
  --account-id 123456789012 \
  --name my-access-point

# Simulate the call — catches policy eval before runtime
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:role/DataPipelineRole \
  --action-names s3:GetObject \
  --resource-arns "arn:aws:s3:us-east-1:123456789012:accesspoint/my-access-point/object/data/file.parquet"

Basic Fix — Align All Three Policies

1. Access Point Resource Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
-     "Principal": { "AWS": "arn:aws:iam::123456789012:root" },
+     "Principal": { "AWS": "arn:aws:iam::123456789012:role/DataPipelineRole" },
      "Action": ["s3:GetObject", "s3:PutObject"],
-     "Resource": "arn:aws:s3:::my-bucket/*"
+     "Resource": "arn:aws:s3:us-east-1:123456789012:accesspoint/my-access-point/object/*"
    }
  ]
}

2. Bucket Policy — Delegation Block

{
  "Version": "2012-10-17",
  "Statement": [
+   {
+     "Effect": "Allow",
+     "Principal": { "AWS": "*" },
+     "Action": "s3:*",
+     "Resource": [
+       "arn:aws:s3:::my-bucket",
+       "arn:aws:s3:::my-bucket/*"
+     ],
+     "Condition": {
+       "StringEquals": {
+         "s3:DataAccessPointAccount": "123456789012"
+       }
+     }
+   }
  ]
}

3. IAM Role Identity Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
-     "Resource": "arn:aws:s3:::my-bucket/*"
+     "Resource": "arn:aws:s3:us-east-1:123456789012:accesspoint/my-access-point/object/*"
    }
  ]
}

Enterprise Best Practice — Least Privilege with Condition Keys

// Access Point Policy — scoped to VPC and org
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:role/DataPipelineRole" },
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:us-east-1:123456789012:accesspoint/my-access-point/object/*",
+     "Condition": {
+       "StringEquals": {
+         "aws:PrincipalOrgID": "o-xxxxxxxxxx"
+       },
+       "StringLike": {
+         "s3:prefix": ["data/pipeline-a/*", "data/pipeline-b/*"]
+       },
+       "Bool": {
+         "aws:SecureTransport": "true"
+       }
+     }
    }
  ]
}

Scope the Access Point to a VPC at creation time — this cannot be changed after creation:

aws s3control create-access-point \
  --account-id 123456789012 \
  --name my-access-point \
  --bucket my-bucket \
  --vpc-configuration VpcId=vpc-0abc123def456

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# .checkov.yml
checks:
  - CKV_AWS_300  # S3 Access Point policy allows public access
  - CKV_AWS_301  # S3 bucket policy delegates to Access Point account

package s3_access_point

deny[msg] {
  resource := input.resource_changes[_]
  resource.type == "aws_s3_access_point"
  policy := json.unmarshal(resource.change.after.policy)
  stmt := policy.Statement[_]
  contains(stmt.Resource, "arn:aws:s3:::")
  not contains(stmt.Resource, "accesspoint")
  msg := sprintf(
    "Access Point policy resource must use Access Point ARN, not bucket ARN. Got: %v",
    [stmt.Resource]
  )
}

- name: Lint S3 Access Point Policies
  run: |
    conftest test ./terraform --policy ./policies/s3_access_point.rego
    checkov -d ./terraform --check CKV_AWS_300,CKV_AWS_301 --hard-fail-on HIGH

output "access_point_arn" {
  value = aws_s3_access_point.main.arn
  # Format: arn:aws:s3:REGION:ACCOUNT:accesspoint/NAME
  # NOT:   arn:aws:s3:::BUCKET
}

# Reference this output — never hardcode
resource "aws_iam_role_policy" "pipeline" {
  policy = jsonencode({
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject", "s3:PutObject"]
      Resource = "${aws_s3_access_point.main.arn}/object/*"
    }]
  })
}