arn:aws:s3:::example-bucket/${tenant}/* can scope object actions to matching S3 keys, but it does not grant or restrict bucket listing. To limit a tenant’s listing, authorize s3:ListBucket separately on the bucket ARN and constrain the request with s3:prefix. Also, ${tenant} is not automatically a built-in IAM variable: it must resolve from a supported request-context key.
Why is an S3 policy not restricting access to a tenant prefix?
Because S3 uses different resource types for object operations and bucket operations. An object ARN such as arn:aws:s3:::example-bucket/acme/* identifies objects whose keys begin with acme/. It can scope object-level actions such as reading or writing, when those actions are granted. It does not cover bucket-level s3:ListBucket, which uses the bucket ARN, arn:aws:s3:::example-bucket.
As an Amazon Associate I earn from qualifying purchases.
A request to list keys therefore needs its own permission. AWS maps S3 actions to resource types in its S3 and IAM action documentation. Treat object access and listing as separate authorization questions rather than assuming an object ARN covers both.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Does Resource: bucket/${tenant}/* allow listing?
No. An object-resource pattern does not itself grant s3:ListBucket. If the caller has no applicable bucket-level listing permission, the object pattern does not make a list request succeed. Conversely, granting s3:ListBucket on the bucket without an appropriate restriction may let a caller list beyond the intended tenant prefix, subject to the rest of the effective policy.
#1 Best Overall
For a tenant-limited list operation, grant s3:ListBucket on the bucket ARN and use the s3:prefix condition key to limit which key prefix the request may list. AWS describes this condition in its S3 policy-key documentation. The requested prefix and the condition must match the workload’s actual key layout.
How should object access and listing be separated?
A shared-bucket policy generally needs distinct statements for object actions and bucket listing. This is a structure to adapt—not a drop-in policy: choose only the actions and prefix shapes the application needs, and check all other applicable policies.
Rank #2
| Need | Resource and permission surface | What to verify |
|---|---|---|
| Read, write, or delete objects | Object ARN, such as arn:aws:s3:::example-bucket/${aws:PrincipalTag/tenant}/*, with only the required object actions |
The resolved tenant value and ARN pattern match the intended object keys. |
| List keys | Bucket ARN, such as arn:aws:s3:::example-bucket, with s3:ListBucket and an s3:prefix condition |
The requested prefix is restricted to the tenant’s permitted path. |
| List object versions | Bucket ARN with s3:ListBucketVersions, if version listing is required |
Version-listing need and the applicable prefix condition are handled. |
AWS’s identity-based S3 policy examples illustrate the distinction between listing a bucket and granting object permissions. Console workflows can need additional permissions beyond those required for a particular API or CLI operation, so identify which interface and actions the workload actually uses.
What does ${tenant} mean to IAM?
IAM substitutes policy variables from request-context values; the syntax alone does not create a variable or supply a tenant identity. AWS documents variables such as ${aws:PrincipalTag/team}. A reusable tenant policy could use a supported key such as ${aws:PrincipalTag/tenant} only when that principal tag is deliberately populated and controlled for the caller.
Rank #3
The policy language version must support variables: AWS identifies 2012-10-17 as the version that introduced them. Variables in a Resource ARN are allowed only in the resource portion, after the fifth colon—not in the service or account portions. See AWS’s documentation on IAM policy variables and tags.
If the context key used by a variable is absent, a resource ARN containing that unresolved variable does not match a resource. The application or identity system must provide a trusted value in the authorization context; a user-controlled or incorrectly mapped value can undermine the intended tenant boundary.
Are S3 “folders” real directories?
No. S3 object keys are names, and a prefix is a leading string in those names. The console presents common prefixes in a folder-like way, but authorization applies to keys and prefixes, not filesystem directories. For example, acme/reports/january.csv has the prefix acme/. A listing condition must align with the actual key strings the client requests. AWS explains this prefix and folder presentation in its S3 access-control documentation.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHow can you check whether the policy enforces tenant boundaries?
- Inspect the complete effective permissions. Review identity policies, bucket policies, and any other applicable controls; one statement cannot establish what the whole deployment permits.
- Confirm the tenant source. Verify the selected IAM context key is supported, present for the intended principal, and populated from a trusted identity source.
- Check each permission surface. Confirm object actions use the intended object ARN pattern, while listing uses the bucket ARN and a restrictive
s3:prefixcondition. - Test both outcomes with real credentials. Use principals representing at least two tenant values. Verify that each can perform only intended operations on its own keys and cannot list or access another tenant’s keys.
- Test missing and malformed context. Confirm that an absent or invalid tenant value fails safely rather than falling back to broader access.
A policy snippet alone cannot prove tenant isolation. The result depends on the resolved request context, the complete effective permissions, and the application’s identity and authorization design.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
