CosmicToast · January 14, 2020 01:50 · Jan 14, 2020
diff --git a/README.md b/README.md
@@ -0,0 +1,32 @@
+# Some useful policies for MinIO
+A small collection, because reasons.
+
+## User Policies
+To apply these:
+
+1. Download the file.
+2. `mcli admin policy add MYMINIO NAME NAME.json` (replace MYMINIO with your configured instance and NAME with the filename).
+3. `mcli admin policy set MYMINIO NAME user=USER` (same as above, replace USER with the user you want to configure).
+
+### UserOnly.json
+This grants the user in question access to ONLY the bucket that matches that user's name.
+For example, the user "foo" will have access ONLY to the "foo" bucket, and no others.
+If they run a listing, they will only see their own bucket.
+
+### UserPrefix.json
+This grants the user in question access to ANY bucket that matches the user's name as a prefix.
+For example, the user "foo" will have access to the bucket "foo" and "foobar", but not "barfoo".
+They will be able to list any buckets they have access to, but no others.
+
+## Bucket Policies
+To apply these:
+
+1. Download the file.
+2. EDIT the file - replace BUCKETNAME with the name of the bucket you want to apply these to.
+3. `mcli policy set-json ./FILE.json MYMINIO/BUCKETNAME` (where FILE.json is the EDITED file, MYMINIO is your configured instance and BUCKETNAME is the name of the bucket you want to apply this to).
+4. Repeat 2-3 for every bucket you want to modify.
+
+### FetchOnly.json
+This policy is similar to ReadOnly in that it allows fetching any object in the bucket.
+However, it does NOT allow listing objects in that bucket.
+This can be useful to make a computation attack more expensive when sharing files in a federated fashion.
diff --git a/fetchonly.json b/fetchonly.json
@@ -0,0 +1,15 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": [
+          "*"
+        ]
+      },
+      "Action": "s3:GetObject",
+      "Resource": "arn:aws:s3:::BUCKETNAME/*"
+    }
+  ]
+}
diff --git a/useronly.json b/useronly.json
@@ -0,0 +1,15 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:*"
+      ],
+      "Resource": [
+        "arn:aws:s3:::${aws:username}",
+        "arn:aws:s3:::${aws:username}/*"
+      ]
+    }
+  ]
+}
diff --git a/userprefix.json b/userprefix.json
@@ -0,0 +1,15 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:*"
+      ],
+      "Resource": [
+        "arn:aws:s3:::${aws:username}*",
+        "arn:aws:s3:::${aws:username}*/*"
+      ]
+    }
+  ]
+}