Skip to content

Instantly share code, notes, and snippets.

@olegbukatchuk

olegbukatchuk/bucket-policies-primer.md

Forked from krishnasrinivas/bucket-policies-primer.md
Created June 26, 2024 12:29
Show Gist options
  • Save olegbukatchuk/ee75005e3548730c4bac0162ac6be310 to your computer and use it in GitHub Desktop.
Save olegbukatchuk/ee75005e3548730c4bac0162ac6be310 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @harshavardhana harshavardhana revised this gist Aug 16, 2017. 1 changed file with 40 additions and 10 deletions.
    50 changes: 40 additions & 10 deletions bucket-policies-primer.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,11 +1,11 @@
    ## Bucket Policy
    Bucket policy is an access policy available for you to grant anonymous permissions to your Minio resources. Bucket policy uses JSON-based access policy language.

    This section presents a few examples of typical use cases for bucket policies. The policies use `bucket` and `examplebucket` strings in the resource value. To test these policies, you need to replace these strings with your bucket name. For more information please read Amazon S3 [access policy language](http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html)
    This section presents a few examples of typical use cases for bucket policies. The policies use `testbucket` strings in the resource value. To test these policies, you need to replace these strings with your bucket name. For more information please read Amazon S3 [access policy language](http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html)

    ### Granting Read-Only Permission to an Anonymous User

    The following example policy grants the s3:GetObject permission to any public anonymous users. This permission allows anyone to read the object data under `testbucket`, which is useful for when you have publicly readable assets. A typical example is a website assets stored in `testbucket`.
    The following example policy grants the `s3:GetObject` permission to any public anonymous users. This permission allows anyone to read the object data under `testbucket`, which is useful for when you have publicly readable assets. A typical example is a website assets stored in `testbucket`.

    ```json
    {
    @@ -30,36 +30,66 @@ The following example policy grants the s3:GetObject permission to any public an
    }
    ```

    The following example policy grants the `s3:GetObject` permission to any public anonymous users. This permission allows anyone to read the object data under `testbucket` matching all the prefixes under `user` further matching everything inside `files/public/*`, which is useful for when you want to organize `user` assets from your application to be publicly available. Most probably a social media profile picture which is kept under public assets in `/user/{username}/files/public/{image.jpg}` .

    ```json
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Action": [
    "s3:GetObject"
    ],
    "Effect": "Allow",
    "Principal": {
    "AWS": [
    "*"
    ]
    },
    "Resource": [
    "arn:aws:s3:::testbucket/user/*/files/public/*"
    ],
    "Sid": ""
    }
    ]
    }
    ```

    Now you can set this policy on your bucket using `aws cli` , following command assumes Minio is running locally at port `9000` and bucket is `testbucket`.
    ```sh
    aws --endpoint-url http://localhost:9000 s3api put-bucket-policy --bucket testbucket --policy file:///tmp/policy.json
    ```

    There are two types of key matches are allowed in bucket policies one is `*` and another is `?`
    ### Advanced

    Now if you have this in your Resource
    In Bucket policy JSON there are two types of key matches are allowed one is `*` and another is `?`

    Now lets say if you have following value in your bucket policy `Resource`
    ```
    arn:aws:s3:::testbucket/user/*/files/public/*
    ```
    then the policies will match

    Then the policies will match an object named `user/harsha/files/public/issue`
    ```
    arn:aws:s3:::testbucket/user/harsha/files/public/issue
    ```
    Here the user is `harsha`

    Now if you have this in your Resource
    Now lets say if you have following value in your bucket policy `Resource`
    ```
    arn:aws:s3:::testbucket/user/?/files/public/*
    ```
    then the policies will match

    Then the policies will match an object named `user/1/files/public/issue`, `?` is different from `*` in meaning - `?` only means to match single character match in wildcard terms.
    ```
    arn:aws:s3:::testbucket/user/1/files/public/issue
    ```
    Here the user is `1` You can even repeat `?` to restrict the character length of the users as well. Lets say if you have 6 repeated `?`

    You can even repeat `?` to restrict the username length of the users as well. Lets say if you have 6 repeated `?`
    ```
    arn:aws:s3:::testbucket/user/??????/files/public/*
    ```
    then the policies will match

    Then the policies will match
    ```
    arn:aws:s3:::testbucket/user/harsha/files/public/issue
    ```
  2. @harshavardhana harshavardhana revised this gist Aug 16, 2017. 1 changed file with 12 additions and 4 deletions.
    16 changes: 12 additions & 4 deletions bucket-policies-primer.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,11 @@
    It would be like this `/user/*/files/public/*` in your bucket policy, for private you don't need since by default all objects are indeed private. Since the key regex is a flat key match should work properly for all users.
    ## Bucket Policy
    Bucket policy is an access policy available for you to grant anonymous permissions to your Minio resources. Bucket policy uses JSON-based access policy language.

    This section presents a few examples of typical use cases for bucket policies. The policies use `bucket` and `examplebucket` strings in the resource value. To test these policies, you need to replace these strings with your bucket name. For more information please read Amazon S3 [access policy language](http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html)

    ### Granting Read-Only Permission to an Anonymous User

    The following example policy grants the s3:GetObject permission to any public anonymous users. This permission allows anyone to read the object data under `testbucket`, which is useful for when you have publicly readable assets. A typical example is a website assets stored in `testbucket`.

    ```json
    {
    @@ -15,16 +22,17 @@ It would be like this `/user/*/files/public/*` in your bucket policy, for priva
    ]
    },
    "Resource": [
    "arn:aws:s3:::testbucket/user/*/files/public/*"
    "arn:aws:s3:::testbucket/*"
    ],
    "Sid": ""
    }
    ]
    }
    ```

    ```
    aws s3api --no-verify-ssl put-bucket-policy --bucket testbucket --policy file:///tmp/policy.json
    Now you can set this policy on your bucket using `aws cli` , following command assumes Minio is running locally at port `9000` and bucket is `testbucket`.
    ```sh
    aws --endpoint-url http://localhost:9000 s3api put-bucket-policy --bucket testbucket --policy file:///tmp/policy.json
    ```

    There are two types of key matches are allowed in bucket policies one is `*` and another is `?`
  3. @harshavardhana harshavardhana created this gist Jun 15, 2017.
    57 changes: 57 additions & 0 deletions bucket-policies-primer.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,57 @@
    It would be like this `/user/*/files/public/*` in your bucket policy, for private you don't need since by default all objects are indeed private. Since the key regex is a flat key match should work properly for all users.

    ```json
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Action": [
    "s3:GetObject"
    ],
    "Effect": "Allow",
    "Principal": {
    "AWS": [
    "*"
    ]
    },
    "Resource": [
    "arn:aws:s3:::testbucket/user/*/files/public/*"
    ],
    "Sid": ""
    }
    ]
    }
    ```

    ```
    aws s3api --no-verify-ssl put-bucket-policy --bucket testbucket --policy file:///tmp/policy.json
    ```

    There are two types of key matches are allowed in bucket policies one is `*` and another is `?`

    Now if you have this in your Resource
    ```
    arn:aws:s3:::testbucket/user/*/files/public/*
    ```
    then the policies will match
    ```
    arn:aws:s3:::testbucket/user/harsha/files/public/issue
    ```
    Here the user is `harsha`

    Now if you have this in your Resource
    ```
    arn:aws:s3:::testbucket/user/?/files/public/*
    ```
    then the policies will match
    ```
    arn:aws:s3:::testbucket/user/1/files/public/issue
    ```
    Here the user is `1` You can even repeat `?` to restrict the character length of the users as well. Lets say if you have 6 repeated `?`
    ```
    arn:aws:s3:::testbucket/user/??????/files/public/*
    ```
    then the policies will match
    ```
    arn:aws:s3:::testbucket/user/harsha/files/public/issue
    ```