Manage bucket policies in Object Storage

Bucket policies define access control rules for your buckets and objects. Each policy is a JSON document with one or more statements, each specifying an effect (Allow or Deny), a principal (who the rule applies to), and the S3 actions to allow or deny.

Prerequisites

• Object Storage enabled and credentials configured: Enable Object Storage
• AWS CLI installed and configured for STACKIT Object Storage: Set up the AWS CLI

Sample bucket policies

Make all objects in a bucket publicly readable:

{
  "Statement": [
    {
      "Sid": "Example-policy1",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "urn:sgws:s3:::my-super-bucket/*"
    }
  ]
}

Make a specific file publicly readable:

{
  "Statement": [
    {
      "Sid": "Example-policy2",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "urn:sgws:s3:::my-super-bucket/picture.jpg"
    }
  ]
}

Restrict full access to a specific credential group:

{
  "Statement": [
    {
      "Sid": "allow-specific-credential-group",
      "Effect": "Deny",
      "NotPrincipal": {
        "AWS": "urn:sgws:identity::12345678901234567890:group/credentials-group-1234"
      },
      "Action": ["s3:*"],
      "Resource": ["arn:aws:s3:::my-super-bucket", "arn:aws:s3:::my-super-bucket/*"]
    }
  ]
}

Read-only access for all credential groups except one:

{
  "Statement": [
    {
      "Sid": "allow-specific-credential-group",
      "Effect": "Deny",
      "NotPrincipal": {
        "AWS": "urn:sgws:identity::12345678901234567890:group/credentials-group-1234"
      },
      "Action": ["s3:Put*", "s3:Delete*", "s3:GetBucket*", "s3:GetEncryption*", "s3:List*"],
      "Resource": ["arn:aws:s3:::my-super-bucket", "arn:aws:s3:::my-super-bucket/*"]
    }
  ]
}

Public read with write and delete restricted to one credential group:

{
  "Statement": [
    {
      "Sid": "public-read",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::my-super-bucket", "arn:aws:s3:::my-super-bucket/*"]
    },
    {
      "Sid": "allow-specific-credential-group",
      "Effect": "Deny",
      "NotPrincipal": {
        "AWS": "urn:sgws:identity::12345678901234567890:group/credentials-group-1234"
      },
      "Action": ["s3:Put*", "s3:Delete*", "s3:GetBucket*", "s3:GetEncryption*", "s3:List*"],
      "Resource": ["arn:aws:s3:::my-super-bucket", "arn:aws:s3:::my-super-bucket/*"]
    }
  ]
}

Restrict access by source IP and limit full access to one credential group:

{
  "Statement": [
    {
      "Sid": "Restrict-IP-Range",
      "Effect": "Deny",
      "Principal": "*",
      "Action": ["s3:*"],
      "Resource": ["arn:aws:s3:::my-super-bucket/*", "arn:aws:s3:::my-super-bucket"],
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": ["192.168.1.3", "192.168.1.4"]
        }
      }
    },
    {
      "Sid": "Restrict-Group2",
      "Effect": "Deny",
      "NotPrincipal": {
        "AWS": "urn:sgws:identity::12345678901234567890:group/credentials-group-1234"
      },
      "Action": ["s3:Create*", "s3:Put*", "s3:Delete*", "s3:Get*"],
      "Resource": ["arn:aws:s3:::my-super-bucket/*", "arn:aws:s3:::my-super-bucket"]
    }
  ]
}

Multiple statements with conditions:

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Principal": {
        "AWS": "urn:sgws:identity::12345678901234567890:group/credentials-group-1234"
      },
      "Resource": "urn:sgws:s3:::my-super-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Principal": {
        "AWS": "urn:sgws:identity::12345678901234567890:group/credentials-group-4567"
      },
      "Resource": "urn:sgws:s3:::my-super-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": ["192.168.1.10", "192.168.1.20"]
        },
        "NotIpAddress": {
          "aws:SourceIp": "0.0.0.0"
        }
      }
    }
  ]
}

Set a bucket policy

Save your policy as a JSON file, then apply it to the bucket:

aws s3api put-bucket-policy \
  --bucket my-super-bucket \
  --policy file://policy.json \
  --endpoint-url https://object.storage.eu01.onstackit.cloud

Get a bucket policy

Retrieve the current policy for a bucket:

aws s3api get-bucket-policy \
  --bucket my-super-bucket \
  --endpoint-url https://object.storage.eu01.onstackit.cloud

Delete a bucket policy

Remove a policy from a bucket:

aws s3api delete-bucket-policy \
  --bucket my-super-bucket \
  --endpoint-url https://object.storage.eu01.onstackit.cloud