Skip to main content
Command reference

vserver object-store-server bucket policy-statement-condition create

Suggest changes

Create a bucket policy statement condition

Availability: This command is available to cluster and Vserver administrators at the advanced privilege level.

Description

The vserver object-store-server bucket policy-statement-condition create command creates a single condition for a bucket policy statement in an object store server bucket.

Parameters

-vserver <Vserver Name> - Vserver Name (privilege: advanced)

This parameter specifies the name of the Vserver on which the bucket policy statement condition needs to be created for the object store server bucket.

-bucket <TextNoCase> - Object Store Server Bucket Name (privilege: advanced)

This parameter specifies the name of the object store server bucket for which the policy statement condition needs to be created. The object store bucket must already exist.

-index <integer> - Statement Index (privilege: advanced)

This parameter specifies the index of the object store server bucket policy statement in which a condition needs to be created. The index must already exist.

-operator {ip-address|not-ip-address|string-equals|string-not-equals|string-equals-ignore-case|string-not-equals-ignore-case|string-like|string-not-like|numeric-equals|numeric-not-equals|numeric-greater-than|numeric-greater-than-equals|numeric-less-than|numeric-less-than-equals|bool|null} - Policy Condition Operator (privilege: advanced)

This parameter specifies the condition operator to be applied on the condition keys specified.

[-source-ips <IP Address or Subnet>,…​] - List of IP Addresses with Access Allowed or Denied (privilege: advanced)

Use this parameter to specify a list of IP addresses for which the access is allowed or denied based on the operator specified.

[-usernames <text>,…​] - List of Usernames with Access Allowed or Denied (privilege: advanced)

Use this parameter to specify a list of object store server users for which the access is allowed or denied based on the operator specified. The user name policy variables '${aws:username}' can be specified here, serving as placeholders that are dynamically replaced with the actual user name during run time based on the request context.

[-prefixes <text>,…​] - List of Prefixes to be Matched (privilege: advanced)

Use this parameter to specify a list of prefixes that are compared with the input prefix value specified at the time of execution of an S3-based command, using the condition operator specified. The user name policy variables '${aws:username}' can be specified here, serving as placeholders that are dynamically replaced with the actual user name during run time based on the request context.

[-max-keys <integer>,…​] - List of Maximum Keys Allowed to be Fetched (privilege: advanced)

Use this parameter to specify a list of max-keys values that are allowed or denied retrieval using an S3 list operation, based on the condition operator specified.

[-delimiters <text>,…​] - List of Delimiters to be Matched (privilege: advanced)

Use this parameter to specify a list of delimiters that are compared with the input delimiter value specified at the time of execution of an S3-based command, using the condition operator specified. The user name policy variables '${aws:username}' can be specified here, serving as placeholders that are dynamically replaced with the actual user name during run time based on the request context.

[-if-match <text>,…​] - Check if the HTTP 'If-Match' header is present or absent in the request (privilege: advanced)

Use this parameter to specify a condition that evaluates the presence or absence of the HTTP 'If-Match' header in the S3 request. This condition key is only supported when the operator is set to 'null'. A value of 'true' under the 'null' operator means the header is absent (null) - the condition evaluates to true if the 'If-Match' header is not included in the request, and the action will be evaluated. A value of 'false' under the 'null' operator means the header is present - the condition evaluates to true if the 'If-Match' header is included in the request, and the action will be evaluated. This condition key is used to enforce conditional writes or restrict object creation unless the request includes the required 'If-Match' header.

[-if-none-match {true|false}] - Check if the HTTP 'If-None-Match' header is present or absent in the request (privilege: advanced)

Use this parameter to specify a condition that evaluates the presence or absence of the HTTP 'If-None-Match' header in the S3 request. This condition key is only supported when the operator is set to 'null'. A value of 'true' under the 'null' operator means the header is absent (null) - the condition evaluates to true if the 'If-None-Match' header is not included in the request, and the action will be evaluated. A value of 'false' under the 'null' operator means the header is present - the condition evaluates to true if the 'If-None-Match' header is included in the request, and the action will be evaluated. This condition key is used to enforce object creation rules such as allowing a create operation only if the object does not already exist.

[-object-creation-operation {true|false}] - Check if the operation is object creation or not (privilege: advanced)

Use this parameter to determine whether the S3 request is a final object creation step or part of a multipart upload setup. This condition key is only supported when the operator is set to 'bool'. A value of 'true' under the 'bool' operator means the request is a final object creation operation - the condition evaluates to true if the request is a 'PutObject' or 'CompleteMultipartUpload' action, and the action will be evaluated. A value of 'false' under the 'bool' operator means the request is not a final object creation operation - the condition evaluates to true if the request is a 'CreateMultipartUpload', 'UploadPart', or 'UploadPartCopy' action, and the action will be evaluated. This condition key is often combined with 'if-match' or 'if-none-match' to enforce conditional headers only on final creation requests, while allowing multipart upload setup steps without those headers.

Examples

The following example creates an object store server bucket policy statement condition for storage virtual machine (SVM) vs1, bucket bucket1, index 1 and ip-address as operator.

cluster1::*> vserver object-store-server bucket policy-statement-condition create -vserver vs1 -bucket bucket1 -index 1 -operator ip-address -source-ips 10.1.1.0/24,10.1.1.1

The following example creates an object store server bucket policy statement condition for storage virtual machine (SVM) vs1, bucket bucket1, index 1, string-like as operator and prefix with the user name policy variable.

cluster1::*> vserver object-store-server bucket policy-statement-condition create -vserver vs1 -bucket bucket1 -index 1 -operator string-like -prefixes ${aws:username}/*

The following example creates an object store server bucket policy statement condition for storage virtual machine (SVM) vs1, bucket bucket1, index 1, string-like as operator and prefix with a specific folder name policy variable.

cluster1::*> vserver object-store-server bucket policy-statement-condition create -vserver vs1 -bucket bucket1 -index 1 -operator string-like -prefixes ${aws:username}/folder/*