S3 Bucket Policy Project 8: ${aws:username} Home Folders

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Story

Prof. Sunil Pawar (नाशिक) व Alicia Gomez (Austin) — एक bucket, अनेक homes.

2. Per-user का?

हे का लागतं?

एक bucket = सोपी ops. Variable = identity → path.

• IAM users
• home/user/*
• List prefix
• Roles ≠ username

3. Policy

हे काय आहे?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "HomeList",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::111122223333:root" },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::rb-student-homes-ap-south-1",
      "Condition": {
        "StringLike": { "s3:prefix": ["home/${aws:username}/*", "home/${aws:username}"] }
      }
    },
    {
      "Sid": "HomeRW",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::111122223333:root" },
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::rb-student-homes-ap-south-1/home/${aws:username}/*"
    }
  ]
}

Line-by-line

1. Principal design note.
2. List prefix.
3. RW home.
4. User expand.
5. Role pitfall.
6. IAM vs bucket note.

4. CLI

कसं करायचं (step by step)

# As user ananya
aws s3 cp notes.txt s3://rb-student-homes-ap-south-1/home/ananya/notes.txt --profile ananya
# upload success

aws s3 ls s3://rb-student-homes-ap-south-1/home/ananya/ --profile ananya
# notes.txt

5. Allow/deny

# ALLOW — own prefix
aws s3 cp s3://rb-student-homes-ap-south-1/home/ananya/notes.txt - --profile ananya
# <file contents>

# DENY — peer prefix
aws s3 cp s3://rb-student-homes-ap-south-1/home/rohan/secret.txt - --profile ananya
# AccessDenied

6. Multi-industry

College, bootcamp, agency, enterprise sync.

7. AccessDenied debugging आणि Policy Simulator

AccessDenied क्रम: BPA → bucket Deny → IAM Allow → KMS → VPCe → ACL. Simulator BPA/VPC/KMS miss करू शकतो — खऱ्या CLI ने test.

# Decode
aws s3api get-bucket-policy --bucket BUCKET --query Policy --output text | python3 -m json.tool
aws s3api get-public-access-block --bucket BUCKET
aws iam simulate-principal-policy --policy-source-arn ARN \
  --action-names s3:GetObject --resource-arns arn:aws:s3:::BUCKET/key.txt
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=GetObject --max-items 5

8. Lab: two-user homes

Org block नसेल तर ap-south-1 (Mumbai). आधी budget alert.

कसं करायचं (step by step)

1. Two users.
2. Upload own.
3. Deny peer.
4. Role pitfall.

Cleanup (billing थांबवा)

1. Cleanup.
2. Groups.

9. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

10. Troubleshooting checklist

1. Region + endpoint.
2. Policy + BPA.
3. Lab user.
4. Sid binary search.
5. CloudTrail.
6. KMS test.
7. VPCe path.
8. Lock cleanup.

11. FAQ

12. Interview Q&A

13. Tips — English, मराठी आणि हिंदी

14. Policy save करण्याआधी checklist

1. Business rule एका वाक्यात.
2. Allow vs Deny-unless; Deny wins.
3. ARN shapes.
4. Condition keys.
5. BPA first.
6. Allow+deny plan.
7. Cleanup plan.
8. json.tool.

15. Policy Simulator walkthrough

Simulator identity/resource typos साठी चांगला; BPA/VPCe/KMS miss होऊ शकतात. नंतर खऱ्या path वरून CLI.

1. Simulator → user/role.
2. Action + ARN.
3. Include bucket policy.
4. CLI confirm.
5. Mismatch → layers.

16. Copy-paste runbook

# 0) Region + names
export AWS_REGION=ap-south-1
export BUCKET=rb-lab-$(date +%s)-ap-south-1

# 1) Create + show BPA
aws s3api create-bucket --bucket $BUCKET --region $AWS_REGION \
  --create-bucket-configuration LocationConstraint=$AWS_REGION
aws s3api get-public-access-block --bucket $BUCKET || true

# 2) Validate + apply policy
python3 -m json.tool policy.json >/dev/null
aws s3api put-bucket-policy --bucket $BUCKET --policy file://policy.json
aws s3api get-bucket-policy --bucket $BUCKET --query Policy --output text | python3 -m json.tool | head

# 3) Allow test + Deny test (fill per project)
# ... project-specific curls / aws s3 cp ...

# 4) Cleanup
aws s3 rm s3://$BUCKET --recursive || true
aws s3api delete-bucket-policy --bucket $BUCKET || true
aws s3api delete-bucket --bucket $BUCKET

17. Industry story bank

वरील प्रत्येक project एक industry story वापरतो. इतर industries मध्ये फक्त bucket/principal/Condition बदला.

• Healthcare: SSE-KMS + OrgID + MFA.
• Fintech: IP + HTTPS + OAC.
• EdTech: OAC only.
• Logistics: VPCe.
• Media: Object Lock.
• Retail: prefix public read.
• SaaS: prefix homes.
• Gov: OrgID + MFA + Lock.

18. AccessDenied debugging flowchart

1. Error code + request id.
2. Bucket + region.
3. BPA.
4. Explicit Deny.
5. Conditions.
6. KMS key policy.
7. OAC id.
8. VPCe path.
9. Simulator + CLI.
10. Support last.

19. PR review checklist

• Valid JSON.
• Required fields.
• No open write.
• Tests.
• Cleanup.

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.