AWS S3 Bucket policy public. How to make object private?

Question

I've a bucket with GetObject available to everyone on full bucket(*). I want to make a few objects private(through Object level operation ACL), i.e. only the bucket owner should have read access to the object. I've gone through all available documentation, but couldn't find any possible way. Can anyone confirm is this possible or not?

Answer 1

You cannot use S3 Object ACLs because ACLs do not have a DENY.

You can modify your S3 policy to specify objects and deny access to individual items.

Example S3 Policy (notice that this policy forbids access to everyone for GetObject for two files):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicReadGetObject",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::mybucket/*"
        },
        {
            "Sid": "DenyPublicReadGetObject",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": [
                "arn:aws:s3:::mybucket/block_this_file",
                "arn:aws:s3:::mybucket/block_this_file_too"
            ]
        }
    ]
}

If you want to add a condition so that certain users can still access the objects, add a condition after the Resource section like this. This condition will allow IAM users john.wayne and bob.hope to still call GetObject.

        "Resource": [
            "arn:aws:s3:::mybucket/block_this_file",
            "arn:aws:s3:::mybucket/block_this_file_too"
        ],
        "Condition": {
            "StringNotEquals": {
                "aws:username": [
                    "john.wayne",
                    "bob.hope"
                ]
            }
        }