...
To start with, set up s3cmd, if you haven't done so already. Here's an article to help you with that: Object Storage: using S3 Bucketsstorage: How to use s3cmd and s3fs.
To enforce a policy located in a JSON file called policy.json upon a bucket called mybucket, we run the command:
...
| Code Block | ||
|---|---|---|
| ||
{
"Version": "2012-10-17",
"Id": "policy-read-any",
"Statement": [
{
"Sid": "read-write-any",
"Effect": "Allow",
"Principal": {
"AWS": [
"*"
]
},
"Action": [
"s3:ListBucket",
"s3:GetObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
} |
Put up IP restrictions to read and write to a bucket:
| Code Block | ||
|---|---|---|
| ||
{ "Sid": "AllowIP", "Effect": "Deny", "Principal": { "AWS": ["*"] }, "Action": [ "s3:ListBucket", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*" ], "Condition": { "IpAddress": { "aws:SourceIp": ["IP-ADDRESS/23"] } } } |
Grant access to specific project credentials
| Code Block | ||
|---|---|---|
| ||
{
"Version": "2012-10-17",
"Id": "S3PolicySomeROSomeRW",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<PROJECT_ID>:root"
},
"Action": [
"s3:ListBucket",
"s3:GetObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<PROJECT_ID>:root"
},
"Action": [
"s3:ListBucket",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
} |