General information about bucket policies
Access to a bucket can be set through an access policy (Bucket policy).A policy consists of rules that allow or deny actions with a resource (a bucket or a group of objects) for all or selected principals (users).The basic principle is that if an access policy is created, everything that is not allowed is prohibited.
The access policy works for any authorized access.Authorized access is considered to be viewing and managing bucket and its objects through the control panel and API.Unauthorized access is considered to be requests to objects in public bucket by public bucket domain or user dom ains.
The Bucket Policy has a maximum size limit of 20 KB.
The access policy can apply to any user who is allowed access to the repository according to the role model, and also defines access for users with roles s3.user, s3.bucket.user and object_storage_user.For more information about the interaction between the role model and access policies, see the Managing Access in S3 tutorial.
Access policies can be managed by the Account Owner and users with the role of member.If a user with the member role has the Projects access area selected, the corresponding project must be added to the user's permission.
Create and manage access policies You can create and manage them in the control panel or via the S3 API according to the requirements of the policy structure. policy structure.
Bucket Policy structure
The Bucket Policy has a JSON structure. Example policy:
{
"Id": "my-bucket-policy",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowObjectDeletion",
"Effect": "Allow",
"Principal": {
"AWS": [
"*"
]
},
"Action": [
"s3:DeleteObject"
],
"Resource": [
"arn:aws:s3:::bucket-name",
"arn:aws:s3:::bucket-name/*",
"arn:aws:s3:::bucket-name/${aws:userid}/*"
],
"Condition": {
"StringEquals": {
"aws:UserAgent": [
"storage-test-user-agent"
]
}
}
},
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::bucket-name/*"
}
]
}
Policy Content:
Rules
Rules are of two types: Allow (Allow) and Deny (Deny).
The authorization or prohibition applies to the actions, resources, and principals added to the rule.
If a policy contains multiple rules, they are applied as follows:
- if at least one permissive rule is met, access will be allowed;
- if at least one deny rule is executed, access will be denied;
- if both permissive and deny rules are executed simultaneously, access will be denied;
- if no rule is executed, access will be denied.
Principals
The rule applies to requests from principals (users):
- user identifiers are specified for authorized requests of certain users ((( you can view the service user identifier in the control panel);
- to all authorized and unauthorized requests, indicated by the
*symbol.
You can only add users with control panel access as principals when configuring the policy through the control panel.
Resources
Resources - a bucket or a set of objects to which the rule will apply. Only resources related to the bucket for which the policy is configured can be specified.
Resources can be specified in formats:
arn:aws:s3:::<bucket-name>- bucket resource, you can specify only one resource of this format (the bucket for which the policy is configured). The resource will work for actions The resource will work for actions related to customizing the bucket, and does not apply to its objects;arn:aws:s3:::<bucket-name>/<prefix>- bucket object resource, where<prefix>- is the prefix to which objects the rule will apply. If you specify*, all bucket objects will be included in the resources;arn:aws:s3::::<bucket-name>/${<variable-name>}- bucket object resource, where<variable-name>- is the name of a wildcard variable (key), which acts as a prefix.
Actions
If you specify *, all actions will be included in the rule.
Terms and conditions
A condition defines in which cases the rule will work. A condition consists of a key, an operator and a value.
If the condition returns true, the condition is satisfied.
Keys
One key can be used in multiple conditions. Multiple values can be assigned to a key.
Operators
The operators compare the values from the resource request to the value specified in the key value in the condition.
Numbers
Strings
Date and time
IP addresses
Bool
IfExists
Null
The number from the query is compared to the number specified in the condition.