|
|
| Line 1: |
Line 1: |
| Currently, Arbutus Object Storage only implements a subset of Amazon's specification for [[https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-iam-policies.html data container polices]]. The following example shows how to create, apply, and view a policy. The first step is create a policy json file:</p> | | Currently, Arbutus Object Storage only implements a subset of Amazon's specification for [https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-iam-policies.html data container polices]. The following example shows how to create, apply, and view a policy. The first step is create a policy json file: |
| <pre>{
| |
| "Version": "2012-10-17",
| |
| "Id": "S3PolicyId1",
| |
| "Statement": [
| |
| {
| |
| "Sid": "IPAllow",
| |
| "Effect": "Deny",
| |
| "Principal": "*",
| |
| "Action": "s3:*",
| |
| "Resource": [
| |
| "arn:aws:s3:::testbucket",
| |
| "arn:aws:s3:::testbucket/*"
| |
| ],
| |
| "Condition": {
| |
| "NotIpAddress": {
| |
| "aws:SourceIp": "206.12.0.0/16"
| |
| "aws:SourceIp": "142.104.0.0/16"
| |
| }
| |
| }
| |
| }
| |
| ]
| |
| }
| |
| </pre>
| |
| <p>This example denies access except from the specified source IP address ranges in Classless Inter-Domain Routing (CIDR) notation. In this example the s3://testbucket is limited to the public IP address range (206.12.0.0/16) used by the Arbutus cloud and the public IP address range (142.104.0.0/16) used by the University of Victoria.</p>
| |