title: what aws permission I should give to acess other s3 buckets
body: <p>In this document (<a href="https://docs.aws.amazon.com/eks/latest/userguide/install-aws-iam-authenticator.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/install-aws-iam-authenticator.html</a>), tab of <code>linux</code>, AWS shared the s3 bucket to download latest version of <code>aws-iam-authenticator</code></p>
  <p>this link is keep changing when new version is released, but the bucket name <code>amazon-eks</code> is never changed.</p>
  <pre><code>curl -o aws-iam-authenticator https://amazon-eks.s3-us-west-2.amazonaws.com/1.21.2/2021-07-05/bin/linux/amd64/aws-iam-authenticator
  </code></pre>
  <p>without aws API permission you can't detect what are new releases in this folder with programming way, if I directly access via browser: <a href="https://amazon-eks.s3-us-west-2.amazonaws.com/1.21.2/2021-07-05/bin/linux" rel="nofollow noreferrer">https://amazon-eks.s3-us-west-2.amazonaws.com/1.21.2/2021-07-05/bin/linux</a></p>
  <p><a href="https://i.stack.imgur.com/UKf0H.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/UKf0H.png" alt="enter image description here" /></a></p>
  <p>So I have to use my own AWS Access keys, and it allowed.</p>
  <pre><code>aws s3 ls s3://amazon-eks/1.21.2/2021-07-05/bin/linux/amd64/
  2021-07-15 08:56:11   35290752 aws-iam-authenticator
  2021-07-15 08:56:31         55 aws-iam-authenticator.md5
  2021-07-15 08:56:31         63 aws-iam-authenticator.sha1
  2021-07-15 08:56:31         87 aws-iam-authenticator.sha256
  2021-07-15 08:56:31    1865035 cni-amd64-v0.6.0.tgz
  2021-07-15 08:56:36         54 cni-amd64-v0.6.0.tgz.md5
  2021-07-15 08:56:36         62 cni-amd64-v0.6.0.tgz.sha1
  2021-07-15 08:56:36         86 cni-amd64-v0.6.0.tgz.sha256
  2021-07-15 08:56:36   36878412 cni-plugins-linux-amd64-v0.8.6.tgz
  2021-07-15 08:57:09         68 cni-plugins-linux-amd64-v0.8.6.tgz.md5
  2021-07-15 08:57:09         76 cni-plugins-linux-amd64-v0.8.6.tgz.sha1
  2021-07-15 08:57:09        100 cni-plugins-linux-amd64-v0.8.6.tgz.sha256
  2021-07-15 08:57:09   43122688 kube-proxy
  2021-07-15 08:57:43         44 kube-proxy.md5
  2021-07-15 08:57:43         52 kube-proxy.sha1
  2021-07-15 08:57:43         76 kube-proxy.sha256
  2021-07-15 08:57:43   46403584 kubectl
  2021-07-15 08:58:23         41 kubectl.md5
  2021-07-15 08:58:23         49 kubectl.sha1
  2021-07-15 08:58:23         73 kubectl.sha256
  2021-07-15 08:58:23  118197040 kubelet
  2021-07-15 08:59:44         41 kubelet.md5
  2021-07-15 08:59:44         49 kubelet.sha1
  2021-07-15 08:59:44         73 kubelet.sha256
  </code></pre>
  <p>Now my question is, how can I set an AWS IAM user with <code>Programmatic access</code> only, which can't access any resources in my aws account, but allow to list the content in public/private s3 bucket?</p>
  <p>I need use this IAM user's access key for a public CICD pipeline build job don't want to take the risk to expose the resources in my own aws account.</p>
  <h3 id="update-am50">Update</h3>
  <p>this is the inline policy for that user</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: &quot;s3:GetObject&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::amazon-eks/*&quot;
          }
      ]
  }
  </code></pre>