홈
제품
Red Hat OpenShift Data Foundation
4.15
Managing hybrid and multicloud resources
Chapter 7. Bucket policies in the Multicloud Object Gateway

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 7. Bucket policies in the Multicloud Object Gateway

OpenShift Data Foundation supports AWS S3 bucket policies. Bucket policies allow you to grant users access permissions for buckets and the objects in them.

7.1. Introduction to bucket policies
링크 복사

Bucket policies are an access policy option available for you to grant permission to your AWS S3 buckets and objects. Bucket policies use JSON-based access policy language. For more information about access policy language, see AWS Access Policy Language Overview.

7.2. Using bucket policies in Multicloud Object Gateway
링크 복사

Prerequisites

A running OpenShift Data Foundation Platform.
Access to the Multicloud Object Gateway (MCG), see Chapter 2, Accessing the Multicloud Object Gateway with your applications.
A valid Multicloud Object Gateway user account. See Creating a user in the Multicloud Object Gatewayfor instructions to create a user account.

Procedure

To use bucket policies in the MCG:

Create the bucket policy in JSON format.

For example:

{
    "Version": "NewVersion",
    "Statement": [
        {
            "Sid": "Example",
            "Effect": "Allow",
            "Principal": [
                    "john.doe@example.com"
            ],
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::john_bucket"
            ]
        }
    ]
}

{
    "Version": "NewVersion",
    "Statement": [
        {
            "Sid": "Example",
            "Effect": "Allow",
            "Principal": [
                    "john.doe@example.com"
            ],
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::john_bucket"
            ]
        }
    ]
}

Copy to Clipboard

Toggle word wrap

Replace john.doe@example.com with a valid Multicloud Object Gateway user account.

Using AWS S3 client, use the put-bucket-policy command to apply the bucket policy to your S3 bucket:
```
aws --endpoint ENDPOINT --no-verify-ssl s3api put-bucket-policy --bucket MyBucket --policy file://BucketPolicy
```
```
# aws --endpoint ENDPOINT --no-verify-ssl s3api put-bucket-policy --bucket MyBucket --policy file://BucketPolicy
```
Copy to Clipboard Toggle word wrap
1. Replace ENDPOINT with the S3 endpoint.
2. Replace MyBucket with the bucket to set the policy on.
3. Replace BucketPolicy with the bucket policy JSON file.
4. Add --no-verify-ssl if you are using the default self signed certificates.
  For example:
  # aws --endpoint https://s3-openshift-storage.apps.gogo44.noobaa.org --no-verify-ssl s3api put-bucket-policy -bucket MyBucket --policy file://BucketPolicy
  Copy to Clipboard Toggle word wrap
  For more information on the put-bucket-policy command, see the AWS CLI Command Reference for put-bucket-policy.
  Note
  The principal element specifies the user that is allowed or denied access to a resource, such as a bucket. Currently, Only NooBaa accounts can be used as principals. In the case of object bucket claims, NooBaa automatically create an account obc-account.<generated bucket name>@noobaa.io.
  Note
  Bucket policy conditions are not supported.

Additional resources

There are many available elements for bucket policies with regard to access permissions.
For details on these elements and examples of how they can be used to control the access permissions, see AWS Access Policy Language Overview.
For more examples of bucket policies, see AWS Bucket Policy Examples.

7.3. Creating a user in the Multicloud Object Gateway
링크 복사

Prerequisites

A running OpenShift Data Foundation Platform.

Download the MCG command-line interface for easier management.

subscription-manager repos --enable=rh-odf-4-for-rhel-8-x86_64-rpms
yum install mcg

# subscription-manager repos --enable=rh-odf-4-for-rhel-8-x86_64-rpms
# yum install mcg

Copy to Clipboard

Toggle word wrap

Note

Specify the appropriate architecture for enabling the repositories using the subscription manager.

For IBM Power, use the following command:

subscription-manager repos --enable=rh-odf-4-for-rhel-8-ppc64le-rpms

# subscription-manager repos --enable=rh-odf-4-for-rhel-8-ppc64le-rpms

Copy to Clipboard

Toggle word wrap

For IBM Z, use the following command:

subscription-manager repos --enable=rh-odf-4-for-rhel-8-s390x-rpms

# subscription-manager repos --enable=rh-odf-4-for-rhel-8-s390x-rpms

Copy to Clipboard

Toggle word wrap

Alternatively, you can install the MCG package from the OpenShift Data Foundation RPMs found at Download RedHat OpenShift Data Foundation page.
Note
Choose the correct Product Variant according to your architecture.

Procedure

Execute the following command to create an MCG user account:

noobaa account create <noobaa-account-name> [--allow_bucket_create=true] [--allowed_buckets=[]] [--default_resource=''] [--full_permission=false]

noobaa account create <noobaa-account-name> [--allow_bucket_create=true] [--allowed_buckets=[]] [--default_resource=''] [--full_permission=false]

Copy to Clipboard

Toggle word wrap

<noobaa-account-name>: Specify the name of the new MCG user account.
--allow_bucket_create: Allows the user to create new buckets.
--allowed_buckets: Sets the user’s allowed bucket list (use commas or multiple flags).
--default_resource: Sets the default resource.The new buckets are created on this default resource (including the future ones).
--full_permission: Allows this account to access all existing and future buckets.

Important

You need to provide permission to access atleast one bucket or full permission to access all the buckets.

맨 위로 이동

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 7. Bucket policies in the Multicloud Object Gateway

7.1. Introduction to bucket policies
링크 복사

7.2. Using bucket policies in Multicloud Object Gateway
링크 복사

7.3. Creating a user in the Multicloud Object Gateway
링크 복사

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 소개

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 7. Bucket policies in the Multicloud Object Gateway

7.1. Introduction to bucket policies링크 복사링크가 클립보드에 복사되었습니다!

7.2. Using bucket policies in Multicloud Object Gateway링크 복사링크가 클립보드에 복사되었습니다!

7.3. Creating a user in the Multicloud Object Gateway링크 복사링크가 클립보드에 복사되었습니다!

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 소개

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

7.1. Introduction to bucket policies
링크 복사

7.2. Using bucket policies in Multicloud Object Gateway
링크 복사

7.3. Creating a user in the Multicloud Object Gateway
링크 복사