I was looking a long time for a policy which binds a user to a bucket. The docs are not very helpful for beginners, but I talked with an advanced user and he said it is okay to share his solution, since he is not on Lemmy

Create a new policy and fill this in:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::${aws:username}"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::${aws:username}/*"
            ]
        }
    ]
}

If you now create a user, just assign the user to only this policy, nothing more. The user is now allowed to create a bucket with the same name as the users. So a user Alex can only create the bucket alex and has complete access to it. The user won’t see other users buckets.

All credits belongs to the very helpful person, not me ☝🏻☺️

  • ndguardian@lemmy.studioEnglish
    1·
    1 year ago

    Hmm…this should work but I do have a concern on it based on my experience with AWS. Maybe this is different with minio though.

    In AWS, S3 bucket names are globally unique. Not just to your AWS account, but across ALL S3 buckets period. So let’s say you have a username of “test” and use that policy. If that user attempts to create a bucket and that bucket name is taken, well that user is out of luck.

    Obviously if minio doesn’t require globally unique bucket names you’re probably fine, but otherwise this could realistically become a problem.