Bucket and group access policies

StorageGRID Webscale uses the Amazon Web Services (AWS) policy language to allow S3 tenants to control access to buckets and objects within those buckets. The StorageGRID Webscale system implements a subset of the S3 REST API policy language. Access policies for the S3 API are written in JSON.

Choices

Access policy overview
There are two kinds of access policies supported by StorageGRID Webscale.
Consistency control settings for policies
By default, any updates you make to group policies are eventually consistent. Once a group policy becomes consistent, the changes can take an additional 15 minutes to take effect, because of policy caching. By default, any updates you make to bucket policies are also eventually consistent.
Using the URN in policy statements
In policy statements, the URN is used in Principal and Resource elements.
Specifying resources in a policy
In policy statements, you can use the Resource element to specify the bucket or object for which permissions are allowed/denied.
Specifying principals in a policy
Use the Principal element to identity the user, group, or tenant account that is allowed/denied access to the resource by the policy statement.
Specifying permissions in a policy
In a policy, the Action element is used to allow/deny permissions to a resource. There are a set of permissions that you can specify in a policy, which are denoted by the element "Action," or alternatively, "NotAction" for exclusion. Each of these elements maps to specific S3 REST API operations.
Using the PutOverwriteObject permission
The s3:PutOverwriteObject permission is a custom StorageGRID Webscale permission that applies to operations that create or update objects. The setting of this permission determines whether the client can overwrite an object's data, user-defined metadata, or S3 object tagging.
Specifying conditions in a policy
You can use conditions to allow policies to take effect based on request values. Conditions consist of operators and key-value pairs.
Specifying variables in a policy
You can use variables in policies to populate policy information when it is available. You can use policy variables in the Resource element and in string comparisons in the Condition element.
Creating policies requiring special handling
Sometimes a policy can grant permissions that are dangerous for security or dangerous for continued operations, such as locking out the root user of the account. The StorageGRID Webscale S3 REST API implementation is less restrictive during policy validation than Amazon, but equally strict during policy evaluation.
Write-once-read-many (WORM) protection
You can create write-once-read-many (WORM) buckets to protect data, user-defined object metadata, and S3 object tagging. You configure the WORM buckets to allow the creation of new objects and to prevent overwrites or deletion of existing content. Use one of the approaches described here.
S3 policy examples
Use the examples in this section to build StorageGRID Webscale access policies for buckets and groups.

Related concepts

S3 bucket policy examples

S3 group policy examples