s3-folder-access.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: Create Policy and Group to allow Cyberduck access to a specific folder in
  a S3 bucket
Parameters:
  Name:
    Type: String
    Description: This should only use letters, numbers, and dashes. It is will be used to label
      resources created by the template so you can find them again.
    AllowedPattern: '[a-zA-Z0-9\-]+'
  S3Bucket:
    Type: String
    Description: The name of the bucket that the policy grants access to.
  FolderPath:
    Type: String
    Description: The path to the folder in the S3 bucket that the policy grants access to.
      It should not contain any slashes.
    AllowedPattern: '[^/]+'
Resources:
  AccessGroup:
    Type: AWS::IAM::Group
    Properties:
      GroupName: !Sub '${Name}-Group-CF-Managed'

  AccessPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub '${Name}-Access-CF-Managed'
      Groups:
      - !Ref AccessGroup
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: AllowUserToSeeBucketListInTheConsole
          Action:
          - s3:ListAllMyBuckets
          - s3:GetBucketLocation
          Effect: Allow
          Resource: '*'
        - Sid: AllowRootAndHomeListingOfBucket
          Action:
          - s3:ListBucket
          Effect: Allow
          Resource:
          - !Sub 'arn:aws:s3:::${S3Bucket}'
          Condition:
            StringEquals:
              s3:prefix:
              - ''
              s3:delimiter:
              - "/"
        - Sid: AllowRootListingWithoutPrefix
          Action:
          - s3:ListBucket
          Effect: Allow
          Resource:
          - !Sub 'arn:aws:s3:::${S3Bucket}'
          Condition:
            'Null':
              s3:prefix: 'true'
            StringEquals:
              s3:delimiter:
              - "/"
        - Sid: AllowListingOfProjectFolder
          Action:
          - s3:ListBucket
          Effect: Allow
          Resource:
          - !Sub 'arn:aws:s3:::${S3Bucket}'
          Condition:
            StringLike:
              s3:prefix:
              - !Sub '${FolderPath}/*'
        - Sid: AllowMostReadActionsOnBucket
          Effect: Allow
          Action:
          - s3:GetAccelerateConfiguration
          - s3:GetAnalyticsConfiguration
          - s3:GetBucketAcl
          - s3:GetBucketCORS
          - s3:GetBucketLogging
          - s3:GetBucketNotification
          - s3:GetBucketPolicy
          - s3:GetBucketRequestPayment
          - s3:GetBucketTagging
          - s3:GetBucketVersioning
          - s3:GetBucketWebsite
          - s3:GetInventoryConfiguration
          - s3:GetIpConfiguration
          - s3:GetLifecycleConfiguration
          - s3:GetMetricsConfiguration
          - s3:GetReplicationConfiguration
          Resource:
          - !Sub 'arn:aws:s3:::${S3Bucket}'
        - Sid: AllowAllS3ActionsOnObjectsInProjectFolder
          Effect: Allow
          Action:
          - s3:GetObject
          - s3:GetObjectAcl
          - s3:GetObjectTagging
          - s3:GetObjectTorrent
          - s3:GetObjectVersion
          - s3:GetObjectVersionAcl
          - s3:GetObjectVersionForReplication
          - s3:GetObjectVersionTagging
          - s3:GetObjectVersionTorrent
          - s3:ListMultipartUploadParts
          - s3:AbortMultipartUpload
          - s3:DeleteObject
          - s3:DeleteObjectTagging
          - s3:DeleteObjectVersionTagging
          - s3:PutObject
          - s3:PutObjectTagging
          - s3:PutObjectVersionTagging
          - s3:ReplicateDelete
          - s3:ReplicateObject
          - s3:ReplicateTags
          - s3:RestoreObject
          - s3:ObjectOwnerOverrideToBucketOwner
          - s3:PutObjectAcl
          - s3:PutObjectVersionAcl

          Resource:
          - !Sub 'arn:aws:s3:::${S3Bucket}/${FolderPath}'
          - !Sub 'arn:aws:s3:::${S3Bucket}/${FolderPath}/*'