title: AWS restrict access to temporary credentials getSessionToken using StsClient
body: <h2>Business Senario</h2>
  
  <p>There are multiple offices which have their own AWS S3 Buckets. No user from one office will have access to another office S3 Bucket.</p>
  
  <p>Hence, for every office, there is a <code>S3 Bucket</code> and also an <code>IAM user</code>. Each IAM user has permission to only one bucket. As the offices don't grow often, IAM user creation and assigning permission is manually done through <code>AWS Console</code>.</p>
  
  <h2>Application Senario</h2>
  
  <p>Browser (Javascript) asks Server (PHP API) for temporary credentials to upload files to <code>AWS S3</code>. PHP API fetches <code>Access key ID</code> and <code>Secret access key</code> from database <em>(based on office logged in)</em>. Then using <code>AWS PHP SDK</code>, calls <a href="https://docs.aws.amazon.com/aws-sdk-php/v3/api/class-Aws.Sts.StsClient.html" rel="nofollow noreferrer"><code>StsClient</code></a> and uses <a href="https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html" rel="nofollow noreferrer"><code>getSessionToken()</code></a> method to get temporary credentials and pass it to Javascript.</p>
  
  <p>PHP Code</p>
  
  <pre><code>use Aws\Sts\StsClient;
  $credentials = new Aws\Credentials\Credentials($resultset['awssecret'], $resultset['awspass']);
  
  $stsoptions = [
    'region'            =&gt; 'ap-south-1',
    'version'           =&gt; '2011-06-15',
    'signature_version' =&gt; 'v4',
    'credentials'       =&gt; $credentials,
  ];
  
  $stsClient = new StsClient($stsoptions);
  $response = $stsClient-&gt;getSessionToken();
  </code></pre>
  
  <h2>Question</h2>
  
  <p>Currently, the IAM user has full access to the respective bucket. I want to restrict the temporary credentials access to only certain authorizations. Like only permission to upload, not delete files or list all files.</p>
  
  <p>Can I pass an additional parameter to <code>StsClient</code> where I can restrict permissions to the bucket?</p>
  
  <p><strong>Edit 1</strong></p>
  
  <p>The user is assigned permissions through policy. Below is the permission added to the policy.</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucketByTags",
                  "s3:GetBucketTagging",
                  "s3:DeleteObjectVersion",
                  "s3:GetObjectVersionTagging",
                  "s3:ListBucketVersions",
                  "s3:GetBucketLogging",
                  "s3:RestoreObject",
                  "s3:ListBucket",
                  "s3:GetAccelerateConfiguration",
                  "s3:GetObjectAcl",
                  "s3:AbortMultipartUpload",
                  "s3:GetObjectVersionAcl",
                  "s3:GetObjectTagging",
                  "s3:GetMetricsConfiguration",
                  "s3:PutObjectTagging",
                  "s3:DeleteObject",
                  "s3:PutBucketVersioning",
                  "s3:GetIpConfiguration",
                  "s3:DeleteObjectTagging",
                  "s3:ListBucketMultipartUploads",
                  "s3:GetBucketWebsite",
                  "s3:PutObjectVersionTagging",
                  "s3:DeleteObjectVersionTagging",
                  "s3:GetBucketVersioning",
                  "s3:GetBucketAcl",
                  "s3:GetReplicationConfiguration",
                  "s3:ListMultipartUploadParts",
                  "s3:PutObject",
                  "s3:GetObject",
                  "s3:GetBucketCORS",
                  "s3:GetAnalyticsConfiguration",
                  "s3:GetObjectVersionForReplication",
                  "s3:GetBucketLocation",
                  "s3:ReplicateDelete",
                  "s3:GetObjectVersion"
              ],
              "Resource": [
                  "arn:aws:s3:::aws:s3:::mybucket",
                  "arn:aws:s3:::*/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p><strong>My solution based on answer suggested by Accepted Answer.</strong></p>
  
  <p>Based on the suggestion in answer, added the permission</p>
  
  <pre><code> {
          "Sid": "VisualEditor1",
          "Effect": "Allow",
          "Action": "sts:AssumeRole",
          "Resource": "*"
   }
  </code></pre>
  
  <p>Now my PHP Code is </p>
  
  <pre><code>$policy = '{
    "Id": "Policy1534086947311",
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "Stmt1534086676951",
        "Action": [
          "s3:PutObject",
        ],
        "Effect": "Allow",
        "Resource": "arn:aws:s3:::mybucket"
        }
      }
    ]
  }';
  
  $awsrole = [
    'Policy' =&gt; $policy,
    'RoleArn' =&gt; 'arn:aws:s3:::mybucket',
    'RoleSessionName' =&gt; 'credApi' // just a random value
  ];
  $response = $stsClient-&gt;assumeRole($awsrole);
  </code></pre>