Skip to main content

Add access rules to the default ONTAP S3 bucket policy

Contributors netapp-ahibbard netapp-aaron-holt netapp-dbagwell netapp-manini netapp-thomi netapp-aherbin
PDFs

You can add access rules to the default bucket policy. The scope of its access control is the containing bucket, so it is most appropriate when there is a single bucket.

Before you begin

An S3-enabled storage VM containing an S3 server and a bucket must already exist.

You must have already created users or groups before granting permissions.

About this task

You can add new statements for new users and groups, or you can modify the attributes of existing statements. Learn more about vserver object-store-server bucket policy in the ONTAP command reference.

User and group permissions can be granted when the bucket is created or as needed later. You can also modify the bucket capacity and QoS policy group assignment.

Beginning with ONTAP 9.9.1, if you plan to support AWS client object tagging functionality with the ONTAP S3 server, the actions GetObjectTagging, PutObjectTagging, and DeleteObjectTagging need to be allowed using the bucket or group policies.

The procedure you follow depends on the interface that you use—​System Manager or the CLI:

System Manager
Steps

  1. Edit the bucket: click Storage > Buckets, click the desired bucket, and then click Edit. When adding or modifying permissions, you can specify the following parameters:

    • Principal: the user or group to whom access is granted.

    • Effect: allows or denies access to a user or group.

    • Actions: permissible actions in the bucket for a given user or group.

    • Resources: paths and names of objects within the bucket for which access is granted or denied.

      The defaults bucketname and bucketname/* grant access to all objects in the bucket. You can also grant access to single objects; for example, bucketname/*_readme.txt.

    • Conditions (optional): expressions that are evaluated when access is attempted. For example, you can specify a list of IP addresses for which access will be allowed or denied.

Note Beginning with ONTAP 9.14.1, you can specify variables for the bucket policy in the Resources field. These variables are placeholders that are replaced with contextual values when the policy is evaluated. For example, If ${aws:username} is specified as a variable for a policy, then this variable is replaced with the request context username, and the policy action can be performed as configured for that user.