AWS S3 Bucket access policy

AWS ELB Access log S3 bucket policy

{
    "Version": "2012-10-17",
    "Id": "AWSConsole-AccessLogs-Policy-1503036723495",
    "Statement": [
        {
            "Sid": "AWSConsoleStmt-1503036723495",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::127311923021 (127 is AWS Loadbalancer Account ID):root"
            },
            "Action": "s3:PutObject",
         "Resource": ["arn:aws:s3:::S3 Bucket Name/foldername/AWSLogs/AWS Your Account ID/*",
                         "arn:aws:s3:::S3 Bucket Name/foldername/AWSLogs/AWS Your Account ID/*",
                         "arn:aws:s3:::S3 Bucket Name/foldername/AWSLogs/AWS Your Account ID/*",
                         "arn:aws:s3:::S3 Bucket Name/foldername/AWSLogs/AWS Your Account ID/*",
                         "arn:aws:s3:::S3 Bucket Name/foldername/AWSLogs/AWS Your Account ID/*",
                         "arn:aws:s3:::S3 Bucket Name/foldername/AWSLogs/AWS Your Account ID/*",
                         "arn:aws:s3:::S3 Bucket Name/foldername/AWSLogs/AWS Your Account ID/*",
                         "arn:aws:s3:::S3 Bucket Name/foldername/AWSLogs/AWS Your Account ID/*",
                         "arn:aws:s3:::S3 Bucket Name/foldername/AWSLogs/AWS Your Account ID/*",
                         "arn:aws:s3:::S3 Bucket Name/foldername/AWSLogs/AWS Your Account ID/*"
          ]       
        }
    ]
}

http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html





AWS S3 bucket Public readonly access policy

{
    "Version": "2008-10-17",
    "Id": "Policy1380877762691",
    "Statement": [
        {
            "Sid": "Stmt1380877761162",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::Bucketname/*"
        }
    ]
}


S3 Bucket copy from one account to another policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::remote aws account number:root",
                    "arn:aws:iam::working aws account number :user/aws user"
                ]
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::Bucketname",
                "arn:aws:s3:::Bucketname/*"
            ]
        }
    ]
}

How to Blocking traffic from a single IP or CIDR range through AWS Web GUI

Open your VPC dashboard ----  go to “Network ACLs” view  -------- choose ACL Rules

         1.    Select the subnet to of your EC2 instances
         2.    Click “Inbound Rules”
         3.    Click “Edit”
         4.    Add a rule to block the traffic

   While setup rules need to understand below which guide how it work

         1.    Rule: Use any number less than 100, 100 is the number of the default accept-all rule. This is important because rules are evaluated in order, and your rule needs to come before the default.
         2.    Type: Select “All traffic”
         3.    Protocol: Locked to “ALL”
         4.    Source: The CIDR you want to block. To match a single IP address, enter it here and append /32. For example, I blocked 49.212.52.94/32
         5.    Select “DENY”

    Now click Save and you should see the updated rules.

    

While searching for a way to block traffic, through AWS web portal you  found lots of articles saying that it wasn’t possible because the security group rules in AWS only support white listing. So this level of control may be a relatively to AWS.