ポリシーでの権限の指定

ポリシーでは、Action要素を使用してリソースに対する権限を許可または拒否します。ポリシーで指定できる一連の権限が用意されており、それらを「Action」要素または「NotAction」要素(除外の場合)で指定します。それぞれがS3 REST APIの特定の処理に対応しています。

次の表に、バケットに適用される権限とオブジェクトに適用される権限を示します。

バケットに適用される権限

権限 S3 REST APIの処理 StorageGRID Webscaleのカスタム設定
s3:CreateBucket PUT Bucket  
s3:DeleteBucket DELETE Bucket  
s3:DeleteBucketMetadataNotification DELETE Bucket metadata notification configuration
s3:DeleteBucketPolicy DELETE Bucket policy  
s3:GetBucketAcl GET Bucket ACL  
s3:GetBucketCompliance GET Bucket compliance
s3:GetBucketConsistency GET Bucket consistency
s3:GetBucketCORS GET Bucket cors  
s3:GetBucketLastAccessTime GET Bucket last access time
s3:GetBucketLocation GET Bucket location  
s3:GetBucketMetadataNotification GET Bucket metadata notification configuration
s3:GetBucketNotification GET Bucket notification  
s3:GetBucketPolicy GET Bucket policy  
s3:GetBucketReplication GET Bucket replication  
s3:GetBucketVersioning GET Bucket versioning  
s3:ListAllMyBuckets GET Service、GET Storage Usage ○(GET Storage Usage)
s3:ListBucket GET Bucket (List Objects)、HEAD Bucket  
s3:ListBucketMultipartUploads List Multipart Uploads  
s3:ListBucketVersions GET Bucket versions  
s3:PutBucketCompliance PUT Bucket compliance
s3:PutBucketConsistency PUT Bucket consistency
s3:PutBucketCORS

DELETE Bucket cors

PUT Bucket cors

 
s3:PutBucketLastAccessTime PUT Bucket last access time
s3:PutBucketMetadataNotification PUT Bucket metadata notification configuration
s3:PutBucketNotification PUT Bucket notification  
s3:PutBucketPolicy PUT Bucket policy  
s3:PutBucketReplication PUT Bucket replication  
s3:PutBucketVersioning PUT Bucket versioning  

オブジェクトに適用される権限

権限 S3 REST APIの処理 StorageGRID Webscaleのカスタム設定
s3:AbortMultipartUpload Abort Multipart Upload  
s3:DeleteObject DELETE Object、DELETE Multiple Objects  
s3:DeleteObjectTagging DELETE Object Tagging  
s3:DeleteObjectVersionTagging DELETE Object Tagging(オブジェクトの特定のバージョン)  
s3:DeleteObjectVersion DELETE Object(オブジェクトの特定のバージョン)  
s3:GetObject GET Object、HEAD Object  
s3:GetObjectAcl GET Object ACL  
s3:GetObjectTagging GET Object Tagging  
s3:GetObjectVersionTagging GET Object Tagging(オブジェクトの特定のバージョン)  
s3:GetObjectVersion GET Object(オブジェクトの特定のバージョン)  
s3:ListMultipartUploadParts List Parts  
s3:PutObject PUT Object、PUT Object - Copy、Initiate Multipart Upload、Complete Multipart Upload、Upload Part、Upload Part - Copy  
s3:PutObjectTagging PUT Object Tagging  
s3:PutObjectVersionTagging PUT Object Tagging(オブジェクトの特定のバージョン)  
s3:PutOverwriteObject PUT Object、PUT Object - Copy、PUT Object tagging、DELETE Object tagging、Complete Multipart Upload