红帽全球峰会此内容没有您所选择的语言版本。
Chapter 7. Bucket policies in the Multicloud Object Gateway
OpenShift Data Foundation supports AWS S3 bucket policies. Bucket policies allow you to grant users access permissions for buckets and the objects in them.
7.1. Introduction to bucket policies
Bucket policies are an access policy option available for you to grant permission to your AWS S3 buckets and objects. Bucket policies use JSON-based access policy language. For more information about access policy language, see AWS Access Policy Language Overview.
The bucket policy configuration may take up to 120 seconds to take effect after it is applied.
7.2. Using bucket policies in Multicloud Object Gateway
Prerequisites
- A running OpenShift Data Foundation Platform.
- Access to the Multicloud Object Gateway (MCG), see Chapter 2, Accessing the Multicloud Object Gateway with your applications
- A valid Multicloud Object Gateway user account. See Creating a user in the Multicloud Object Gatewayfor instructions to create a user account.
Procedure
To use bucket policies in the MCG:
Create the bucket policy in JSON format.
For example:
{ "Version": "NewVersion", "Statement": [ { "Sid": "Example", "Effect": "Allow", "Principal": { "AWS": "john.doe@example.com" }, "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::john_bucket" ] } ] }Replace
john.doe@example.comwith a valid Multicloud Object Gateway user account.Using AWS S3 client, use the
put-bucket-policycommand to apply the bucket policy to your S3 bucket:# aws --endpoint ENDPOINT --no-verify-ssl s3api put-bucket-policy --bucket MyBucket --policy file://BucketPolicy-
Replace
ENDPOINTwith the S3 endpoint. -
Replace
MyBucketwith the bucket to set the policy on. -
Replace
BucketPolicywith the bucket policy JSON file. Add
--no-verify-sslif you are using the default self signed certificates.For example:
# aws --endpoint https://s3-openshift-storage.apps.gogo44.noobaa.org --no-verify-ssl s3api put-bucket-policy -bucket MyBucket --policy file://BucketPolicyFor more information on the
put-bucket-policycommand, see the AWS CLI Command Reference for put-bucket-policy.NoteThe principal element specifies the user that is allowed or denied access to a resource, such as a bucket. Currently, Only NooBaa accounts can be used as principals. In the case of object bucket claims, NooBaa automatically create an account
obc-account.<generated bucket name>@noobaa.io.NoteBucket policy conditions are not supported.
-
Replace
Additional resources
- There are many available elements for bucket policies with regard to access permissions.
- For details on these elements and examples of how they can be used to control the access permissions, see AWS Access Policy Language Overview.
- For more examples of bucket policies, see AWS Bucket Policy Examples.
-
OpenShift Data Foundation version 4.17 introduces the bucket policy elements
NotPrincipal,NotAction, andNotResource. For more information on these elements, see IAM JSON policy elements reference.
7.3. Creating a user in the Multicloud Object Gateway
Prerequisites
- A running OpenShift Data Foundation Platform.
Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.
NoteChoose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.
Procedure
Execute the following command to create an MCG user account:
$ noobaa account create <noobaa-account-name> [--allow_bucket_create=true] [--default_resource=''] [--force_md5_etag=false] [--gid=-1] [--new_buckets_path='/'] [--nsfs_account_config=false] [--nsfs_only=true] [--uid=-1]<allow_bucket_create>- Specify if this account be allowed to create new buckets.
<default_resource>- Specify the default resource on which new buckets are created.
<force_md5_etag>-
Specify if
md5 etagcalculation be enabled for the account. <gid_number>- Specify the NSFS GID.
<new_buckets_path>- Specify the path where the new buckets are created.
<nsfs_account_config>- Specify if NSFS account needs to be created.
<nsfs_only>- Set if this account is used only for NSFS.
<uid_number>- Specify the NSFS UID.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}