Geek Answers Handbook

Amazon S3 Folder Permissions

I use Amazon S3 to archive my client documents in one bucket and a series of folders as such to distinguish each client.

MyBucket/0000001/.. MyBucket/0000002/.. MyBucket/0000003/..

My clients are now looking for a way to offline backup their files to their local machine. I would like to create a permission set at a given folder level to view / download these files only in a specific folder.

I want to do this outside of my application, I mean that I would like to create a permission set in the S3 browser and tell my clients to use some third application to communicate with their area. Does anyone know if this is possible? I am opposed to writing a module to automate this, because currently there is simply not enough demand for them.

+4
source share
2 answers

IAM policies can be used in conjunction with bucket policies to control this access.

Each individual client will require its own IAM profile, and you must configure policies to restrict access to objects for these accounts only.

Here is the AWS documentation:

http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingIAMPolicies.html

I would like to specifically highlight Example 1 in this document, which does exactly what you want.

+8
source

Refer to the following policy to prevent the user from downloading or listing objects for specific folders only. I created a policy that allows me to list only the objects folder1 and folder2, and also allows me to put the object in folder1 and prevent downloading to other folders of buckets. The policy operates as follows: 1. Insert all folders with a bucket 2.List objects and folders of allowed folders 3. Uploads files only to allowed folders

{"Version": "2012-10-17", "Approval": [{"Sid": "AllowUserToSeeBucketListInTheConsole", "Action": ["s3: ListAllMyBuckets", "S3: GetBucketLocation"], "Effect": " Allow "," Resource ": [" ARN: AWS: s3: "]}, {" Sid ":" AllowListingOfFolder1And2 "," Action ": [" S3: "]," Effect ":" Reject "," Resource " : ["ARN: AWS: s3: bucketname"], "Status": {"StringNotLike": {"s3: prefix": ["Folder1 /", "Folder2 /"]}, "StringLike": {"s3: prefix ":" ""}}}, {"Sid": "Allow fetching "," Effect "," Reject "," Action ":" s3: PutObject "," NotResource ":" arn: aws: s3: bucketname / folder1 / "}]}

0
source

More articles:


All Articles