AWS Security Cookbook

Granting READ for AWS users using predefined groups from the CLI

We can grant READ for any AWS user using the AuthenticatedUser predefined group by performing the following steps:

1. If you followed along with the previous section, remove the List objects permission for the bucket that was granted to Everyone.
2. Create a policy that grants access to the AuthenticatedUsers group and save it as acl-grant-authenticated-users.json:

{  "Owner": {    "DisplayName": "awsseccookbook",    "ID": "5df5b6014ae606808dcb64208aa09e4f19931b3123456e152c4dfa52d38bf8fd"  },  "Grants": [    {      "Grantee": {        "Type": "Group",        "URI": "http://acs.amazonaws.com/groups/global/AuthenticatedUsers"      },      "Permission": "READ"    }  ]}

Here, the Owner element has the current account's display ...