You have an S3 bucket that stores photos. You also configure the Web Identity Federations (Amazon, Google, and Facebook) to provide temporary credentials to users who can download the photos from the bucket. Each web identity provider has its own directory in the bucket. You want to make sure that federated users can only access their specific folder. Which of the following S3 bucket policy is suitable?

Answer options:

A.{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": [
"arn:aws:s3:::BUCKET-NAME/Amazon/*",
"arn:aws:s3:::BUCKET-NAME/Google/*",
"arn:aws:s3:::BUCKET-NAME/Facebook/*"
]
}
}
B.{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::BUCKET-NAME/${aws:FederatedProvider}/*"
}
}
C.{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Principal": "${aws:FederatedProvider}",
"Action": "s3:GetObject",
"Resource": [
"arn:aws:s3:::BUCKET-NAME/",
"arn:aws:s3:::BUCKET-NAME/*"
]
}
}
D.{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::BUCKET-NAME/*",
"Condition": {
"StringLike": {
"aws:PrincipalArn": "${aws:FederatedProvider}"
}
}
}
}

Correct Answer – B
In this scenario, the condition key aws:FederatedProvider should be used. The key identifies which IdP is used to authenticate the user. For example, if the user is authenticated through Amazon, the key would contain the value www.amazon.com. Details can be found in https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#condition-keys-wif.
Option A is incorrect: Because all three directories are listed in the Resource field. As a result, authenticated users can access all of them. It does not align with the requirements of the question.
Option B is CORRECT: Because the aws:FederatedProvider key is configured as a policy variable in the resource ARN. Each folder is only available to users authenticated by the related IdP.
Option C is incorrect: Because the Resource field does not differentiate the IdP providers so authenticated users can access all three folders.
Option D is incorrect: Because the condition key should be put in the Resource field which enables users to have the permissions on their folder.