@dkocher commented

Not exactly sure without testing why the above policy doesn't work but you could simplify it by narrowing down the Resource instead of a prefix condition.

{
   "Statement":[
   {
      "Action": [ 
        "s3:ListAllMyBuckets", 
        "s3:GetBucketLocation", 
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": [ "arn:aws:s3:::*" ]
    },
    {
      "Effect":"Allow",
      "Action":["s3:PutObject","s3:GetObject","s3:GetObjectVersion",
      "s3:DeleteObject","s3:DeleteObjectVersion"],
      "Resource":"arn:aws:s3:::bucket/site/wp-content/themes/*"
    }
   ]
}

c1a2ae1 commented

Not sure why this was closed, as this issue persists. For various security reasons, I need to give users permission to list only specific directories. This can't be accomplished by narrowing the Resource because the ListBucket ACL applies only to buckets. CyberDuck attempts to list the entire bucket on load, even though a prefix has been specified.

@dkocher commented

Replying to [comment:3 max@…]:

Not sure why this was closed, as this issue persists. For various security reasons, I need to give users permission to list only specific directories. This can't be accomplished by narrowing the Resource because the ListBucket ACL applies only to buckets. CyberDuck attempts to list the entire bucket on load, even though a prefix has been specified.

Can you elaborate what you mean by list the entire bucket. We list all buckets if no default path has been set in the bookmark or list the default bookmark path otherwise on login.

c1a2ae1 commented

Here's what my policy looks like:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "s3:*",
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::my-bucket-name",
            "Condition": {
                "StringLike": {
                    "s3:prefix": "path/to/folder/"
                }
            }
        },
        {
            "Action": "s3:*",
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::my-bucket-name/path/to/folder/*"
        }
    ]
}

The first statement allows bucket actions on folder and the second statement allows object actions on folder. The result is that users with this policy can only read/write/list one directory in my-bucket-name.

Using CyberDuck, I click "Open Connection", enter my Access Key ID and Secret Access Key, and in "More Options", enter the path to the directory: my-bucket-name/path/to/folder. When I click "Connect", I get an error:

Listing directory folder failed.[[br]]
Access Denied: Please contact your web hosting service provider for assistance.

My best guess is that CyberDuck attempts to list the entire bucket (as opposed to the one directory) and fails (since listing is restricted to using that prefix).

@dkocher commented

Please post the transcript from the log drawer (⌘-L).

@dkocher commented

I just noted that you are reporting this issue against version 4.2.1. Please upgrade to the latest release and reopen this issue if the problem persists.