|
|
| Line 114: |
Line 114: |
| Other more sophisticated examples can be found in the s3cmd [https://www.s3express.com/help/help.html help site] or s3cmd(1) man page. | | Other more sophisticated examples can be found in the s3cmd [https://www.s3express.com/help/help.html help site] or s3cmd(1) man page. |
|
| |
|
| = Bucket policies =
| | Instructions on [[ Arbutus_object_storage#Managing_data_container_(bucket)_policies_for_your_Arbutus_Object_Store | managing bucket policies ]] for your object store, including examples using s3cmd are available on the main [[Arbutus_object_storage | object storage]] page. |
| {{Warning
| |
| |title=Attention
| |
| |content=
| |
| Be careful with policies because an ill-conceived policy can lock you out of your bucket.
| |
| }}
| |
| | |
| Currently, Arbutus Object Storage only implements a subset of Amazon's specification for [[https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-iam-policies.html bucket polices]]. The following example shows how to create, apply, and view a bucket's policy. The first step is create a policy json file, e.g. testbucket.policy :</p>
| |
| <pre>{
| |
| "Version": "2012-10-17",
| |
| "Id": "S3PolicyId1",
| |
| "Statement": [
| |
| {
| |
| "Sid": "IPAllow",
| |
| "Effect": "Deny",
| |
| "Principal": "*",
| |
| "Action": "s3:*",
| |
| "Resource": [
| |
| "arn:aws:s3:::testbucket",
| |
| "arn:aws:s3:::testbucket/*"
| |
| ],
| |
| "Condition": {
| |
| "NotIpAddress": {
| |
| "aws:SourceIp": "206.12.0.0/16"
| |
| "aws:SourceIp": "142.104.0.0/16"
| |
| }
| |
| }
| |
| }
| |
| ]
| |
| }
| |
| </pre>
| |
| <p>This example denies access except from the specified source IP address ranges in Classless Inter-Domain Routing (CIDR) notation. In this example the s3://testbucket is limited to the public IP address range (206.12.0.0/16) used by the Arbutus cloud and the public IP address range (142.104.0.0/16) used by the University of Victoria.</p>
| |
| | |
| <p>Once you have your policy file, you can implement that policy on the bucket:</p>
| |
| <p><code>s3cmd setpolicy testbucket.policy s3://testbucket</code></p>
| |
| | |
| <p>To view the policy you can use the following command:</p>
| |
| <p><code>s3cmd info s3://testbucket</code></p>
| |
|
| |
|
| [[Category:Cloud]] | | [[Category:Cloud]] |
| </translate> | | </translate> |