(upbeat music)
(keyboard clicks)
- [Narrator] Hi, I'm Jansen, a cloud support engineer
here at the AWS office in Sydney.
Sometimes customers ask me how they can grant permissions
to specific users so they can access
a specific folders in an Amazon s3 bucket.
So let me show you how to do this.
After logging into the AWS Management Console,
navigate to the Amazon s3 console.
Here you have my bucket in my company drive.
In this bucket I have the three folders in the root level.
Inside of the Home folder, I have five more folders,
one for each of my users.
Now, I will create an IAM policy
to provide the user "ian" permissions
to list all the buckets I have in my AWS account,
list the objects in the root and home folder levels,
and any objects inside the user's home folder "/home/ian",
and only in my bucket "my-company-drive".
Get, add, and remove objects
inside the user's home folder "/home/ian"
and only in my bucket, "my-company-drive".
To do this, I will use an IAM policy with four statements.
Let's take a look at each statement.
The first one grants permissions
to execute the actions "ListAllMyBuckets"
and "GetBucketLocation" for all my buckets.
With this permissions, my user will be able
to list all the s3 buckets in my AWS account.
The second one grants permissions to execute the action
"ListBucket", only in my specific s3 bucket,
"my-company-drive",
when the prefix of the object is equal to new,
for allowing list objects in the s3 bucket root level,
and "home/" for allowing list objects in the home level.
Because my user "ian" will access their (mumbles) bucket
by using the Amazon s3 console
and because when using the Amazon s3 console,
it's not possible to list only some specific folders
in the same level,
I must grant permissions to my user to be able
to list all folders and files in the s3 bucket root level
and the folder "home/".
Because of this, I've included the two previous conditions
on my policy.
Anyway, the user "ian" can see what folders and files
are inside the s3 bucket root level and folder "home/".
But that won't be able to answer them.
Finally, because the Amazon s3 console uses the slash
as a delimiter to show s3 bucket's organizing in folders,
I'm enforcing the use of this corrector for this purpose
by using the conditioned key "s3:delimiter".
The third statement complements the previous one
by granting permissions to the action "ListBucket",
but now the prefix is anything
inside the folder "home/ian/*".
For this scenario,
I use the condition operation "StringLike"
instead of string close.
The fourth statement grants permissions to execute
the actions "GetObject" for downloading files,
"PutObject" for uploading files and creating new folders,
and "DeleteObject" for deleting files or folders,
but only inside the folder "home/ian/*".
Okay, now I am back on s3 console.
Let's create an IAM policy
and associate it with the user "ian".
Navigate to the IAM dashboard.
Now, choose policy in the left side
and then choose the button "Create policy".
Go to the Jansen tab,
delete the default content,
and paste the IAM policy here.
Go ahead and choose "Review policy".
Let's enter a name for this policy
and then let's go ahead
by choosing the button "Create policy".
Now, for associating our IAM policy to the user,
choose "Users" in IAM console.
Select the user by choosing its username.
Go ahead and choose "Add permissions".
Select "Attach existing policies directly"
and then find the policy in the search field.
Select the policy,
choose the button "Next: Review"
and then choose "Add permissions".
Now, since the user "ian" has the IAM policy attached to it,
let's check if everything's working fine.
I'll start by logging into AWS console
using "ian" credentials.
Then, I'll go ahead by choosing services and then s3.
As you can see, the user "ian" can view all the s3 buckets
I have in my AWS account.
However, if I try to list the content of an s3 bucket
older than my company drive, I got an error message.
Now,
let's come back and access the bucket "my-company-drive"
that user "ian" has permissions to access.
I can see all the files in the s3 bucket root level,
but I got an error message if I try to access any folder
other than "home".
I'll go ahead and access the home folder.
I can see all the content of the folder "home",
but I can't access any (mumbles) folders
except for ian's folder.
As expected, I can access the folder "home/ian/*"
and see all the content, upload a new object,
and delete an object.
So, after doing this, the most common next question is:
"Will I have to create one IAM policy for each user?
"What about if I have hundreds or even thousands of users?"
For solving that, we can create a multiple user policy
by using the policy variable AWS username.
Let's replace the actual username
with the variable AWS username.
Now, when the policy is evaluated by IAM,
the variable will be replaced
with the values inside the request,
which, in this case, is the username.
Thanks for watching
and happy cloud computing from all of us here at AWS.
(upbeat music)