Chapter 7. Bucket policies in the Multicloud Object Gateway

1. Create the bucket policy in JSON format. See the following example:

   {
       "Version": "NewVersion",
       "Statement": [
           {
               "Sid": "Example",
               "Effect": "Allow",
               "Principal": [
                       "john.doe@example.com"
               ],
               "Action": [
                   "s3:GetObject"
               ],
               "Resource": [
                   "arn:aws:s3:::john_bucket"
               ]
           }
       ]
   }

   There are many available elements for bucket policies. For details on these elements and examples of how they can be used, see AWS Access Policy Language Overview.

   For more examples of bucket policies, see AWS Bucket Policy Examples.

   Instructions for creating S3 users can be found in Section 7.3, “Creating an AWS S3 user in the Multicloud Object Gateway”.

2. Using AWS S3 client, use the put-bucket-policy command to apply the bucket policy to your S3 bucket:

   # aws --endpoint ENDPOINT --no-verify-ssl s3api put-bucket-policy --bucket MyBucket --policy BucketPolicy

   Replace ENDPOINT with the S3 endpoint

   Replace MyBucket with the bucket to set the policy on

   Replace BucketPolicy with the bucket policy JSON file

   Add --no-verify-ssl if you are using the default self signed certificates

   For example:

   # aws --endpoint https://s3-openshift-storage.apps.gogo44.noobaa.org --no-verify-ssl s3api put-bucket-policy -bucket MyBucket --policy file://BucketPolicy

   For more information on the put-bucket-policy command, see the AWS CLI Command Reference for put-bucket-policy.

Procedure

1. In your OpenShift Storage console, navigate to Overview Object Service select the Multicloud Object Gateway link:

   

2. Under the Accounts tab, click Create Account:

   

3. Select S3 Access Only, provide the Account Name, for example, john.doe@example.com. Click Next:

   

4. Select S3 default placement, for example, noobaa-default-backing-store. Select Buckets Permissions. A specific bucket or all buckets can be selected. Click Create: