Deny S3 access if the request does not comes from specific role - json

Question

I have a policy below here:
If the request comes from that role it should give delete access otherwise it should give access denied including IAM users as well.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:DeleteObject",
"Resource": [
"arn:aws:s3:::abc-bucket",
"arn:aws:s3:::abc-bucket/*"
],
"Condition": {
"StringNotEquals": {
"aws:PrincipalArn": [
"arn:aws:iam::000000000:role/EC2",
"arn:aws:iam::000000000:role/Eventbridge"
]
}
}
}
]
}
After trying this Still got access denied I am i doing something wrong here?
I tried deleting that via this command:
aws s3 rm s3://abc-bucket/tmp-test-delete
delete failed: s3://abc-bucket/test-delete An error occurred (Access Denied) when calling the DeleteObject operation: Access Denied

Answer 1

It appears that you have two requirements:
Allow specific roles to Delete objects from the bucket
This can be done by adding an Allow policy on the IAM Role itself (without using a Bucket Policy). It would look something like:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::abc-bucket/*",
}
]
}
Deny other users/roles from being able to Delete objects on the bucket
Amazon S3 is "Deny by Default". Therefore, if you are not currently granting any IAM Users or IAM Roles the ability to Delete objects off this (or all) S3 bucket, then there is no need to do anything -- they will be denied the ability to delete objects by default.
However, if you have an existing policy that grants this permission to users (eg Admin users have s3:* permissions on all buckets), then you would need to use the Bucket Policy that you have shown. The Deny will overrule the Allow, thereby preventing them from being able to Delete objects from the bucket.
However, think carefully about why they were given the permissions in the first place -- it might be that users have been granted too much access and the existing Allow policies should be reduced, rather than adding Deny policies.