What are ACLs
What are policies
Configure access via ACLs and policies:
• Allow an object downloading by ACL
• Allow a bucket listing by ACL
• Allow an object downloading by policy
• Deny access to a bucket (hide a directory) by policy
• Allow requests from a particular IP by policy
• Allow requests from a particular website by policy
• Grant access to a bucket to users by policy
What are ACLs?
ACLs, or Access Control Lists, are sets of rules that determine who has access to objects stored in S3 and what actions they are allowed to perform on those objects. Proper configuration of ACLs helps ensure the security of stored data.
Note: The storage owner is responsible for configuring ACLs. Use the S3cmd documentation commands to manage ACLs for objects in Gcore S3 storage.
ACLs for objects can be configured for a variety of actions, such as:
| Actions | Description |
|
--acl-public |
Making an object publicly accessible |
| --acl-private | Making an object private |
| --acl-grant=full-control | Granting full control over the bucket |
| --acl-grant=read | Allowing the listing of objects in the bucket |
| --acl-grant=read_acp | Allowing the reading of ACLs |
| --acl-grant=write | Allowing recording, overwriting, and deleting of objects |
| --acl-grant=write_acp |
Allowing the writing of ACLs |
What are policies?
Policies are JSON files that provide a more detailed way to control access to objects and buckets. They allow you to specify which actions a specific user or all users are allowed or denied to perform.
The maximum request size in the policy is 20 KB.
Note: The storage owner is responsible for configuring policies. Use the official documentation actions, conditions, and resource types to manage policies for objects in Gcore S3 storage.
Configure access via ACLs and policies
We've provided examples of ACLs and policies for some common tasks in managing S3 storage.
In all the commands and JSON files, you need to replace the following with your values:
- Replace sample.jpg with your object.
- Replace my_bucket with your bucket.
- Replace https://s-ed1.cloud.gcore.lu with your hostname.
Allow an object downloading by ACL
To allow all users to download an object, use the following command with the public ACL action --acl public:
s3cmd setacl s3://my_bucket/sample.jpg --acl-public
Note: This will make the specified object in the bucket publicly available to everyone by the link https://s-ed1.cloud.gcore.lu/my_bucket/sample.jpg.
Allow listing of a bucket by ACL
To allow all users to list objects in a bucket, use the following command with the public ACL action --acl-grant=read:
s3cmd setacl s3://my_bucket/sample.jpg --acl-grant=read
Allow an object downloading by policy
To allow all users to download an object:
1. Create a JSON file with the following policy:
{
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my_bucket/*"
}
]
}
2. Apply the access policy to the bucket with the following command:
s3cmd setpolicy policy_name.json s3://my_bucket/
Deny access to a bucket (hide a directory) by policy
To deny all users access to the "s3:GetObject" operation on a specific directory in a bucket while still allowing access to the higher-level bucket:
1. Create a JSON file with the following policy:
{
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my_bucket/*"
},
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my_bucket/secret/*"
}
]
}
Note: Replace arn:aws:s3:::my_bucket/secret/* with the path to the directory you want to hide and arn:aws:s3:::my_bucket/* with the path to the higher-level bucket.
2. Apply the policy to the bucket with the following command:
s3cmd setpolicy policy_name.json s3://my_bucket/
Allow requests from a particular IP by policy
To allow requests to the storage bucket from a specified IP address:
1. Create a JSON file with the following policy:
{
"Statement":
[
{
"Sid": "IPAllow",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::",
"arn:aws:s3:::/*"
],
"Condition":
{
"IpAddress": {"aws:SourceIp": "10.0.0.0/24"}
}
}
]
}
Note: Replace 10.0.0.0/24 with your desired IP address.
2. Apply the policy to the bucket with the following command:
s3cmd setpolicy policy_name.json s3://my_bucket/
Allow requests from a particular website by policy
To allow referrals to the storage bucket from specified websites:
1. Create a JSON file with the following policy:
{
"Statement":
[
{
"Sid":"Allow get requests originating from www.example.com and example.com.",
"Effect":"Allow",
"Principal":"*",
"Action":["s3:GetObject","s3:GetObjectVersion"],
"Resource":"arn:aws:s3:::/*",
"Condition":
{
"StringLike":{"aws:Referer":["http://www.example.com/*","http://example.com/*"]}
}
}
]
}
Note: Replacehttp://www.example.com/andhttp://example.com/with your desired websites.
2. Apply the policy to the bucket with the following command:
s3cmd setpolicy policy_name.json s3://my_bucket/
Grant a user access to a bucket by policy
To grant a user access to a bucket:
1. Create a JSON file with the following policy:
{
"Statement":[
{
"Effect":"Allow",
"Principal": {"AWS":["arn:aws:iam:::user/1234-test"]},
"Action":["s3:GetObject","s3:ListBucket"],
"Resource":["arn:aws:s3:::my_bucket/*", "arn:aws:s3:::my_bucket"]
}
]
}
Note: Replace 1234-test with the actual name of your storage in your account, and arn:aws:s3:::my_bucket with the actual name of your bucket.
2. Apply the policy to the bucket with the following command:
s3cmd setpolicy policy_name.json s3://my_bucket/