9.5 Update 4 and Amazon S3

[dalbertson]

Hi All,

I have played around with the minimal permissions a bit and tested in my lab and this seems to work. I was able to tier data, restore, and delete all.

Code: Select all

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SecureBucketPolicy0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:AbortMultipartUpload",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketLocation",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname/*",
                "arn:aws:s3:::bucketname"
            ]
        },
        {
            "Sid": "SecureBucketPolicy1",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:HeadBucket"
            ],
            "Resource": "*"
        }
    ]
}

[david.tosoff]

This is great! Thanks @dalbertson!

In case it helps anyone else:
I was building a similar limited-scope policy in my homelab over the weekend, but using Wasabi. I stole Dustin's snippet from above, but the "HeadBucket" action permission wasn't accepted in the Wasabi console, giving me an error when creating the policy.
Using "s3:ListBucket" instead worked for me.

EDIT: Upon further reading, this actually may open up more access than desired to all buckets. Striking that line all together from this second part of the policy appears to work for me with Wasabi. Was able to add extent without issue, and Capacity Tier is currently syncing without issue (so far).

[hcs_tech]

What permissions should be checked here, see image below, on this screen to block public access but still allow IAM user access for the Veeam Object Storage backup?

Image: https://prnt.sc/pc8r8k

[chris.arceneaux]

You can safely Block all public access in the screenshot you've shown. Public access is defined as someone being able to access your S3 Bucket without authentication.

As the IAM user should have the necessary access applied to it, it's not deemed public access.

[veremin]

What permissions should be checked here, see image below, on this screen to block public access but still allow IAM user access for the Veeam Object Storage backup?

Your post has been merged into the existing discussion. Kindly, check the answers provided above. Thanks!

[AuGL]

Just as a heads up, there are a few of us internally working on a Cloud Tier Deep Dive White Paper which will contain explanations around scenarios like this. We hope to have it out in 4-6 weeks.

Any update on when this white paper will be available?

[veremin]

If you're interested in list of minimal permissions needed for Capacity Tier, then, we're planning to publish it next week. QA team has just confirmed the list. Thanks!

[AuGL]

Yes the minimum permissions would be good as we are looking to set this up shortly, so just looking for "best practice" settings all round.

[veremin]

The documentation has been updated. Find the minimal permissions set here. Thanks!

[AuGL]

Thanks, you guys rock!