Failed Access Denied: S3 properties on us-east-1 region

When I created s3 buckets at each regions including us-east-1, us-west1, us-west-2, and ap-northeast-1 and applied the IAM policies below to a IAM group. I got some of the properties of other than us-east-1 region somehow.
I created an IAM group and attached two IAM policies with the group.

IAM policy to define the buckets to operate and access source IP address.

{
  "Statement": [
    {
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "xxx.xxx.xxx.xxx/32",
            "xxx.xxx.xxx.xxx/32"
          ]
        }
      },
      "Resource": [
        "arn:aws:s3:::bucket_name.ap-northeast-1",
        "arn:aws:s3:::bucket_name.ap-northeast-1/*",
        "arn:aws:s3:::bucket_name.us-west-1",
        "arn:aws:s3:::bucket_name.us-west-1/*",
        "arn:aws:s3:::bucket_name.us-west-1",
        "arn:aws:s3:::bucket_name.us-west-1/*",
        "arn:aws:s3:::bucket_name.us-west-2",
        "arn:aws:s3:::bucket_name.us-west-2/*"
      ],
      "Action": "s3:*",
      "Effect": "Allow"
    }
  ],
  "Version": "2012-10-17"
}

• IAM policy to list all the buckets for a s3 tool like S3 Browser

{
  "Statement": [
    {
      "Resource": "*",
      "Action": "s3:List*",
      "Effect": "Allow"
    }
  ],
  "Version": "2012-10-17"
}

I got the properties of us-west-1, us-west-2, ap-northeast-1, but couldn't get those of us-east-1, though the same IAM policies are applied.


I successfully got the properties of us-east-1 after adding the action as follows.

{
  "Statement": [
    {
      "Resource": "*",
      "Action": [
        "s3:List*",
        "s3:Get*"
      ],
      "Effect": "Allow"
    }
  ],
  "Version": "2012-10-17"
}

I am wondering if us-east-1 (US standard) region is different from other regions in how to apply IAM policy because it is the 1st region of AWS???

AWS EBS snapshots with IAM Cross-Account Access

I recently released a document about how to take EBS snapshots with IAM Cross-Account acccess on slideshare. The summary of its feature is as follows:

• Cross-account access by using IAM roles allows to take EBS snapshots of other AWS accounts.
• Use the AWS STS (Security Token Service) to request limited-privilege credentials for AWS IAM role.
• Possible to centralize the environment to take EBS snapshots for each AWS accounts.

There are ways to take EBS snapshots, such as via Console Management, AWS CLI, and AWS SDKs and it is also possible to regularly and automatically take snapshots by using cron and AWS CLI or writing scripts with AWS SDKs. 

I believe that those who have several AWS accounts such as Management Service Provider, System Integrator, or Enterprise Company especially need to create the environment to take snapshots for each AWS accounts or maybe they can install the environment on each EC2 instances itself. 

The problem is that the environment (EC2 Instances) to take EBS snapshots are increasing as they have more AWS Accounts they have to manage. EBS snapshots with IAM Cross-Account acccess will be one of the solution to centralize the environment to lower cost.

Finally, I prepared a CloudFormation template to deploy a stack with the environment to install and run the script. Please try it and give me a feedback if you have any on it.

Aws ebs snapshot with iam cross account access from Naoya Hashimoto