Skip to main content

Enable S3 client users

Contributors netapp-lenida netapp-thomi netapp-aherbin
PDFs

To enable S3 client users to access NAS data, you must map S3 user names to corresponding NAS users, then grant them permission to access the NAS data using bucket service polices.

Before you begin

User names for client access – LINUX/UNIX, Windows and S3 client users – must already exist.

You should be aware that some S3 functionality is not supported by S3 NAS buckets.

About this task

Mapping an S3 user name to a corresponding LINUX/UNIX or Windows user allows authorization checks on the NAS files to be honored when those files are accessed by S3 clients. S3 to NAS mappings are specified by providing an S3 user name Pattern, which can be expressed as a single name or a POSIX regular expression, and a LINUX/UNIX or Windows user name Replacement.

In case there is no name-mapping present, default name-mapping will be used, where the S3 user name itself will be used as the UNIX user name and Windows user name. You can modify the UNIX and Windows default user name mappings with the vserver object-store-server modify command.

Only local name-mapping configuration is supported; LDAP is not supported.

After S3 users are mapped to NAS users, you can grant permissions to users specifying the resources (directories and files) to which they have access and the actions they are allowed or not allowed to perform there.

System Manager

  1. Create local name mappings for UNIX or Windows clients (or both).

    1. Click Storage > Buckets, then select the S3/NAS-enabled storage VM.

    2. Select Settings, then click Arrow icon in Name Mapping (under Host Users and Groups).

    3. In the S3 to Windows or S3 to UNIX tiles (or both), click Add, then entered the desired Pattern (S3) and Replacement (NAS) user names.

  2. Create a bucket policy to provide client access.

    1. Click Storage > Buckets, click Menu options icon next to the desired S3 bucket, then click Edit.

    2. Click Add and supply the desired values.

      • Principal - Provide S3 user names or use the default (all users).

      • Effect - Select Allow or Deny.

      • Actions - Enter actions for these users and resources. The set of resource operations that the object store server currently supports for S3 NAS buckets are: GetObject, PutObject, DeleteObject, ListBucket, GetBucketAcl, GetObjectAcl, GetObjectTagging, PutObjectTagging, DeleteObjectTagging, GetBucketLocation, GetBucketVersioning, PutBucketVersioning and ListBucketVersions. Wildcards are accepted for this parameter.

      • Resources - Enter folder or file paths in which the actions are allowed or denied, or use the defaults (root directory of the bucket).