AWS Security Cookbook

Creating policies using the AWS CLI

In this section, we will create a policy with the JSON we generated in the previous recipe. If you are following along from the previous section, detach the current policy from the group (or user) and confirm that the testuser user cannot list the contents of the bucket. Let's get started:

1. Create a file called my-s3-list-bucket-policy.json with the following JSON policy:

{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "MyS3ListBucketPolicy",      "Effect": "Allow",      "Action": "s3:ListBucket",      "Resource": "arn:aws:s3:::awsseccookbook",      "Condition": {        "DateLessThan": {          "aws:EpochTime": "1609415999"        }      }    }  ]}

The preceding policy will only allow access if the current EPOCH timestamp is less than the EPOCH timestamp ...