AWS Identity and Access Management (IAM) is an AWS service that helps administrators securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use Amazon S3 resources in directory buckets and S3 Express One Zone operations. You can use IAM for no additional charge.
By default, users don't have permissions for directory buckets. To grant access permissions for directory buckets, you can use IAM to create users, groups, or roles and attach permissions to those identities. For more information about IAM, see Security best practices in IAM in the IAM User Guide.
To provide access, you can add permissions to your users, groups, or roles through the following means:
For more information about IAM for S3 Express One Zone, see the following topics.
PrincipalsWhen you create a resource-based policy to grant access to your buckets, you must use the Principal element to specify the person or application that can make a request for an action or operation on that resource. For directory bucket policies, you can use the following principals:
An AWS account
An IAM user
An IAM role
A federated user
For more information, see Principal in the IAM User Guide.
ResourcesAmazon Resource Names (ARNs) for directory buckets contain the s3express namespace, the AWS Region, the AWS account ID, and the directory bucket name, which includes the AWS Zone ID. (an Availability Zone or Local Zone ID).
To access and perform actions on your directory bucket, you must use the following ARN format:
arn:aws:s3express:region:account-id:bucket/base-bucket-name--zone-id--x-s3To access and perform actions on your access point for a directory bucket, you must use the following ARN format:
arn:aws::s3express:region:account-id:accesspoint/accesspoint-basename--zone-id--xa-s3For more information about ARNs, see Amazon Resource Names (ARNs) in the IAM User Guide. For more information about resources, see IAM JSON Policy Elements: Resource in the IAM User Guide.
Actions for directory bucketsIn an IAM identity-based policy or resource-based policy, you define which S3 actions are allowed or denied. Actions correspond to specific API operations. With directory buckets, you must use the S3 Express One Zone namespace to grant permissions, called s3express.
When you allow the s3express:CreateSession permission, the CreateSession API operation retrieves a temporary session token for all Zonal endpoint API (object level) operations. The session token returns credentials that are used for all other Zonal endpoint API operations. As a result, you don't grant access permissions to Zonal API operations with IAM policies. Instead, CreateSession enables access for all object level operations. For the list of Zonal API operations and permissions, see Authenticating and authorizing requests.
To learn more about the CreateSession API operation, see CreateSession in the Amazon Simple Storage Service API Reference.
You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation with the same name. However, in some cases, a single action controls access to more than one API operation. Access to bucket-level actions can be granted in only IAM identity-based policies (user or role) and not bucket policies.
For more information about how to configure access point policies, see Configuring IAM policies for using access points for directory buckets.
For more information, see Actions, resources, and condition keys for Amazon S3 Express.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4