# Bucket Policies

**Bucket Policies** provides specific users, or all users, conditional and granular permissions for specific actions.

Policy conditions can be used to assign permissions for a range of objects that match the condition and can be used to automatically assign permissions to newly uploaded objects.

How access to resources is managed when using the S3 protocol is described in <https://docs.aws.amazon.com/AmazonS3/latest/dev/s3-access-control.html> and you can use the information as the basis for understanding and using S3 bucket policies in cegedim.cloud Object Storage Service.

This section provides basic information about the use of bucket policies.

## Manage Bucket Policies <a href="#bucketpolicies-managebucketpolicies" id="bucketpolicies-managebucketpolicies"></a>

**Bucket policies** can be managed using **aws s3api** (other tools or SDK works too)**:**

* get-bucket-policy
* put-bucket-policy
* delete-bucket-policy

{% hint style="info" %}
We use **aws s3** and **aws s3api** command line tools from AWSCLIv2 on Linux.

`${S3_ENDPOINT}` and `${S3_PROFILE}` are environment variables.
{% endhint %}

### Create Bucket Policy <a href="#bucketpolicies-createbucketpolicy" id="bucketpolicies-createbucketpolicy"></a>

Create JSON file and configure your policy :

{% code lineNumbers="true" %}

```json
{
    "Version": "2012-10-17",
    "Id": "S3PolicyId1",
    "Statement": [
        {
            "Sid": "Grant permission to <access_key>",
            "Effect": "Allow",
            "Principal": ["<access_key>"],
            "Action": [ "s3:PutObject","s3:GetObject" ],
            "Resource":[ "bucket-test/*" ]
        }
    ]
}
```

{% endcode %}

{% hint style="warning" %}
The **`Principal`** element specifies the **Object User Access Key** that is allowed or denied access to a resource.

You can use a wildcard '**`*`'** to mean all Object Users.

![(warning)](https://docs.cegedim.cloud/s/-qt169r/8804/1tgy0xz/_/images/icons/emoticons/warning.svg) Be careful, set a wildcard as '**`Principal`**' in a Bucket Policy means **anyone** can access to resources and perform allowed actions.
{% endhint %}

Apply it to the bucket: **bucket-test**

{% code overflow="wrap" %}

```bash
aws s3api --endpoint-url=${S3_ENDPOINT} put-bucket-policy --bucket bucket-test --policy file://policy.json --profile ${S3_PROFILE}
```

{% endcode %}

### Get Bucket Policy <a href="#bucketpolicies-getbucketpolicy" id="bucketpolicies-getbucketpolicy"></a>

{% code overflow="wrap" %}

```bash
aws s3api --endpoint-url=${S3_ENDPOINT} get-bucket-policy --bucket bucket-test --profile ${S3_PROFILE}
```

{% endcode %}

### Delete Bucket Policy <a href="#bucketpolicies-deletebucketpolicy" id="bucketpolicies-deletebucketpolicy"></a>

{% code overflow="wrap" %}

```bash
aws s3api --endpoint-url=${S3_ENDPOINT} delete-bucket-policy --bucket bucket-test --profile ${S3_PROFILE}
```

{% endcode %}

## Bucket Policy management scenarios <a href="#bucketpolicies-bucketpolicyscenarios" id="bucketpolicies-bucketpolicyscenarios"></a>

### Grant bucket permissions to a user <a href="#bucketpolicies-grantbucketpermissionstoauser" id="bucketpolicies-grantbucketpermissionstoauser"></a>

{% code lineNumbers="true" %}

```json
{
    "Version": "2012-10-17",
    "Id": "S3PolicyId1",
    "Statement": [
        {
            "Sid": "Grant permission to user1",
            "Effect": "Allow",
            "Principal": ["<access_key>"],
            "Action": [ "s3:PutObject","s3:GetObject" ],
            "Resource":[ "arn:aws:s3:::mybucket/*" ]
        }
    ]
}
```

{% endcode %}

### Grant read only bucket permissions to a user <a href="#bucketpolicies-grantreadonlybucketpermissionstoauser" id="bucketpolicies-grantreadonlybucketpermissionstoauser"></a>

{% code lineNumbers="true" %}

```json
{
  "Version": "2012-10-17",
  "Id": "s3ReadOnlyforUser",
  "Statement": [
    {
      "Sid": "Grant read permission to user1",
      "Effect": "Allow",
      "Principal": ["<access_key>"],
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::mybucket",
        "arn:aws:s3:::mybucket/*"
      ]
    }
  ]
}
```

{% endcode %}

### Grant bucket permissions to all users (public access) <a href="#bucketpolicies-grantbucketpermissionstoallusers-publicaccess" id="bucketpolicies-grantbucketpermissionstoallusers-publicaccess"></a>

cegedim.cloud Object Storage Service is directly accessible from Internet.

{% hint style="danger" %}
If you grant public access to your Bucket or a subset of your Bucket, **anyone can GET your objects**.
{% endhint %}

For more information, please read [manage-bucket-access](https://academy.cegedim.cloud/storage/object-storage/object-storage-get-started/manage-bucket-access "mention").

{% code title="Public bucket" lineNumbers="true" %}

```json
{
    "Version": "2012-10-17",
    "Id": "S3PolicyId2",
    "Statement": [
        {
            "Sid": "Public Access to mybucket",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [ "s3:GetObject" ],
            "Resource":[ "arn:aws:s3:::mybucket/*" ]
        }
    ]
}
```

{% endcode %}

#### Accessing Bucket via baseURL in a Web Browser

With **public access**, Bucket content can be accessed directly using a WEB browser.

The URL to access to a public Bucket follow this format:\
https\://\<object-store\_name>.storage-\[eb4|et1].cegedim.cloud/\<bucket\_name>

Example : *<https://cos-cegedimit-myit.storage-eb4.cegedim.cloud/my-bucket>*

### Grant bucket permissions to all users (public access) to Objects under a specific prefix <a href="#bucketpolicies-grantbucketpermissionstoallusers-publicaccess-toobjectsunderaspecificprefix" id="bucketpolicies-grantbucketpermissionstoallusers-publicaccess-toobjectsunderaspecificprefix"></a>

cegedim.cloud Object Storage Service is directly accessible from Internet.

{% hint style="danger" %}
If you grant public access to your Bucket or a subset of your Bucket, **anyone can GET your objects**.
{% endhint %}

With the following policy, all objects in the bucket `my-bucket` and under the prefix `public/` are publicly accessible:

{% code lineNumbers="true" %}

```json
{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Sid":"public-access-based-on-prefix",
      "Effect":"Allow",
      "Principal": "*",
      "Action":["s3:GetObject"],
      "Resource":["arn:aws:s3:::my-bucket/public/*"]
      }
  ]
}
```

{% endcode %}

## Supported Policy Operations & Conditions <a href="#bucketpolicies-supportedpolicyoperations-and-conditions" id="bucketpolicies-supportedpolicyoperations-and-conditions"></a>

### Supported bucket policy operations

#### Permissions for Object Operations <a href="#bucketpolicies-permissionsforobjectoperations" id="bucketpolicies-permissionsforobjectoperations"></a>

<table data-full-width="true"><thead><tr><th>Permission keyword</th><th>Supported S3 operations</th></tr></thead><tbody><tr><td><code>s3:GetObject</code> applies to latest version for a version-enabled bucket</td><td><code>GET</code> Object, <code>HEAD</code> Object</td></tr><tr><td><code>s3:GetObjectVersion</code></td><td><code>GET</code> Object, <code>HEAD</code> Object This permission supports requests that specify a version number</td></tr><tr><td><code>s3:PutObject</code></td><td><code>PUT</code> Object, <code>POST</code> Object, Initiate Multipart Upload, Upload Part, Complete Multipart Upload PUT Object</td></tr><tr><td><code>s3:GetObjectAcl</code></td><td><code>GET</code> Object ACL</td></tr><tr><td><code>s3:GetObjectVersionAcl</code></td><td><code>GET</code> ACL (for a Specific Version of the Object)</td></tr><tr><td><code>s3:PutObjectAcl</code></td><td><code>PUT</code> Object ACL</td></tr><tr><td><code>s3:PutObjectVersionAcl</code></td><td><code>PUT</code> Object (for a Specific Version of the Object)</td></tr><tr><td><code>s3:DeleteObject</code></td><td><code>DELETE</code> Object</td></tr><tr><td><code>s3:DeleteObjectVersion</code></td><td><code>DELETE</code> Object (a Specific Version of the Object)</td></tr><tr><td><code>s3:ListMultipartUploadParts</code></td><td>List Parts</td></tr><tr><td><code>s3:AbortMultipartUpload</code></td><td>Abort Multipart Upload</td></tr></tbody></table>

#### Permissions for Bucket Operations <a href="#bucketpolicies-permissionsforbucketoperations" id="bucketpolicies-permissionsforbucketoperations"></a>

<table data-full-width="true"><thead><tr><th>Permission keyword</th><th>Supported S3 operations</th></tr></thead><tbody><tr><td><code>s3:DeleteBucket</code></td><td><code>DELETE</code> Bucket</td></tr><tr><td><code>s3:ListBucket</code></td><td><code>GET</code> Bucket (List Objects), <code>HEAD</code> Bucket</td></tr><tr><td><code>s3:ListBucketVersions</code></td><td><code>GET</code> Bucket Object versions</td></tr><tr><td><code>s3:GetLifecycleConfiguration</code></td><td><code>GET</code> Bucket lifecycle</td></tr><tr><td><code>s3:PutLifecycleConfiguration</code></td><td><code>PUT</code> Bucket lifecycle</td></tr></tbody></table>

#### Permissions for Bucket Sub-resource Operations <a href="#bucketpolicies-permissionsforbucketsub-resourceoperations" id="bucketpolicies-permissionsforbucketsub-resourceoperations"></a>

<table data-full-width="true"><thead><tr><th>Permission keyword</th><th>Supported S3 operations</th></tr></thead><tbody><tr><td><code>s3:GetBucketAcl</code></td><td><code>GET</code> Bucket acl</td></tr><tr><td><code>s3:PutBucketAcl</code></td><td><code>PUT</code> Bucket acl</td></tr><tr><td><code>s3:GetBucketCORS</code></td><td><code>GET</code> Bucket cors</td></tr><tr><td><code>s3:PutBucketCORS</code></td><td><code>PUT</code> Bucket cors</td></tr><tr><td><code>s3:GetBucketVersioning</code></td><td><code>GET</code> Bucket versioning</td></tr><tr><td><code>s3:PutBucketVersioning</code></td><td><code>PUT</code> Bucket versioning</td></tr><tr><td><code>s3:GetBucketPolicy</code></td><td><code>GET</code> Bucket policy</td></tr><tr><td><code>s3:DeleteBucketPolicy</code></td><td><code>DELETE</code> Bucket policy</td></tr><tr><td><code>s3:PutBucketPolicy</code></td><td><code>PUT</code> Bucket policy</td></tr></tbody></table>

### Supported bucket policy conditions

{% hint style="info" %}
The condition element is used to specify conditions that determine when a policy is in effect.

The following tables show the condition keys that are supported by cegedim.cloud Object Storage Service and that can be used in condition expressions.
{% endhint %}

#### Supported generic AWS condition keys <a href="#bucketpolicies-supportedgenericawsconditionkeys" id="bucketpolicies-supportedgenericawsconditionkeys"></a>

<table data-full-width="true"><thead><tr><th>Key name</th><th>Description</th><th>Applicable operators</th></tr></thead><tbody><tr><td><code>aws:CurrentTime</code></td><td>Used to check for date/time conditions</td><td>Date operator</td></tr><tr><td><code>aws:EpochTime</code></td><td>Used to check for date/time conditions using a date in epoch or UNIX time (see Date Condition Operators).</td><td>Date operator</td></tr><tr><td><code>aws:principalType</code></td><td>Used to check the type of principal (user, account, federated user, etc.) for the current request.</td><td>String operator</td></tr><tr><td><code>aws:SourceIp</code></td><td>Used to check the requester's IP address.</td><td>String operator</td></tr><tr><td><code>aws:UserAgent</code></td><td>Used to check the requester's client application.</td><td>String operator</td></tr><tr><td><code>aws:username</code></td><td>Used to check the requester's user name.</td><td>String operator</td></tr></tbody></table>

#### Supported S3-specific condition keys for object operations <a href="#bucketpolicies-supporteds3-specificconditionkeysforobjectoperations" id="bucketpolicies-supporteds3-specificconditionkeysforobjectoperations"></a>

<table data-full-width="true"><thead><tr><th>Key name</th><th>Description</th><th>Applicable permissions</th></tr></thead><tbody><tr><td><code>s3:x-amz-acl</code></td><td>Sets a condition to require specific access permissions when the user uploads an object.</td><td><p>s3:PutObject</p><p>s3:PutObjectAcl</p><p>s3:PutObjectVersionAcl</p></td></tr><tr><td><p><code>s3:x-amz-grant-permission</code></p><p>(for explicit permissions), where permission can be:read, write, read-acp, write-acp, full-control</p></td><td>Bucket owner can add conditions using these keys to require certain permissions.</td><td><p>s3:PutObject</p><p>s3:PutObjectAcl</p><p>s3:PutObjectVersionAcl</p></td></tr><tr><td><code>s3:x-amz-server-side-encryption</code></td><td>Requires the user to specify this header in the request.</td><td><p>s3:PutObject</p><p>s3:PutObjectAcl</p></td></tr><tr><td><code>s3:VersionId</code></td><td>Restrict the user to accessing data only for a specific version of the object</td><td><p>s3:PutObject</p><p>s3:PutObjectAcl</p><p>s3:DeleteObjectVersion</p></td></tr></tbody></table>

#### Supported S3-specific condition keys for bucket operations <a href="#bucketpolicies-supporteds3-specificconditionkeysforbucketoperations" id="bucketpolicies-supporteds3-specificconditionkeysforbucketoperations"></a>

<table data-full-width="true"><thead><tr><th>Key name</th><th>Description</th><th>Applicable permissions</th></tr></thead><tbody><tr><td><code>s3:x-amz-acl</code></td><td>Set a condition to require specific access permissions when the user uploads an object</td><td><p>s3:CreateBucket</p><p>s3:PutBucketAcl</p></td></tr><tr><td><p><code>s3:x-amz-grant-permission</code></p><p>(for explicit permissions), where permission can be:read, write, read-acp, write-acp, full-control</p></td><td>Bucket owner can add conditions using these keys to require certain permissions</td><td><p>s3:CreateBucket</p><p>s3:PutBucketAcl</p></td></tr><tr><td><code>s3:prefix</code></td><td>Requires the user to specify this header in the request.</td><td><p>s3:PutObject</p><p>s3:PutObjectAcl</p></td></tr><tr><td><code>s3:delimiter</code></td><td>Require the user to specify the delimiter parameter in the Get Bucket (List Objects) request.</td><td><p>s3:PutObject</p><p>s3:PutObjectAcl</p><p>s3:DeleteObjectVersion</p></td></tr><tr><td><code>s3:max-keys</code></td><td>Limit the number of keys <strong>Object Storage Service</strong> returns in response to the Get Bucket (List Objects) request by requiring the user to specify the max-keys parameter.</td><td><p>s3:ListBucket</p><p>s3:ListBucketVersions</p></td></tr></tbody></table>