> CDS > Hedvig S3 Protocol-Compatible Object Storage User Guide > Access Control > S3 Bucket Policy Support

S3 Bucket Policy Processing

The S3 bucket policy is processed as follows.

For each request, if the Resource, Principal, and Action elements are satisfied, then a valid rule for this combination is assumed.

If a rule exists and the effect is DENY, then conditions are not taken into consideration.

If a rule exists and the effect is ALLOW, then conditions for the combination are evaluated and allowed or denied based on whether the Condition element is satisfied.

element

description

values supported

Sid

Identifies the description or statement.

(This element is optional and is not substantially used by Hedvig.)

Effect

Determines if a rule is applied when the Principal, Resource, Action, and Condition elements are all satisfied.

ALLOW or DENY

Principal

Identifies users who can perform, or users who cannot perform, specific actions.

(The NotPrincipal element is not supported.)

To allow any user, including anonymous requests, specify the * wildcard character as the value of the Principal element.

Otherwise, the format is:

{ "HOSUID" : "uid1,uid2,uid3 ..."}

Resource

Identifies the bucket and object path to which the specified rule statement applies.

(The NotResource element is not supported.)

To include all resources, specify
the * wildcard character as the value of the Resource element.

Otherwise, the format is:

[ "/bucketname",
    "/bucketname/objectpath" ...]

The * wildcard character can be used to denote all, and the ? wildcard character can be used for a single character. For example, the following value will match any object in a bucket:

"/bucketname/*"

Action

Allows or denies the specified action the resource, based on the Effect element.

(The NotAction element is not supported.)

To include all actions, specify
the * wildcard character as the value of the Action element.

To include only a specific set of actions, the format is:

["s3:GetObject",
       "s3:ListBucket" ...]

See S3 Bucket and Object Action Support.

The * wildcard character can be used to denote a subset of operations. For example, the value:

"s3:*Object"

will include the following:

s3:GetObject
s3:PutObject
s3:DeleteObject

Condition

Specifies a condition that, when satisfied, applies a rule.

(The IpAddress and the NotIpAddress elements are both supported.)

The format for a condition is:

Condition : { condition_type:
  { condition_key:
    condition_value } }

The format for condition_key is aws:SourceIp.

The condition_value can be specified as a single IP address or a comma-separated list of IP addresses in CIDR (classless interdomain routing) format.

Loading...