Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

此内容没有您所选择的语言版本。

Chapter 7. Bucket policies in the Multicloud Object Gateway

OpenShift Data Foundation supports AWS S3 bucket policies. Bucket policies allow you to grant users access permissions for buckets and the objects in them.

7.1. Introduction to bucket policies
复制链接

Bucket policies are an access policy option available for you to grant permission to your AWS S3 buckets and objects. Bucket policies use JSON-based access policy language. For more information about access policy language, see AWS Access Policy Language Overview.

7.2. Using bucket policies in Multicloud Object Gateway
复制链接

Prerequisites

Procedure

To use bucket policies in the MCG:

  1. Create the bucket policy in JSON format.

    For example: 

    {
    "Version": "NewVersion",
    "Statement": [
        {
            "Sid": "Example",
            "Effect": "Allow",
            "Principal": [
                    "john.doe@example.com"
            ],
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::john_bucket"
            ]
        }
    ]
}
    Copy to Clipboard Toggle word wrap

    Replace john.doe@example.com with a valid Multicloud Object Gateway user account.

  2. Using AWS S3 client, use the put-bucket-policy command to apply the bucket policy to your S3 bucket: 

    # aws --endpoint ENDPOINT --no-verify-ssl s3api put-bucket-policy --bucket MyBucket --policy file://BucketPolicy
    Copy to Clipboard Toggle word wrap
    1. Replace ENDPOINT with the S3 endpoint.
    2. Replace MyBucket with the bucket to set the policy on.
    3. Replace BucketPolicy with the bucket policy JSON file.

    4. Add --no-verify-ssl if you are using the default self signed certificates.

      For example: 

      # aws --endpoint https://s3-openshift-storage.apps.gogo44.noobaa.org --no-verify-ssl s3api put-bucket-policy -bucket MyBucket --policy file://BucketPolicy
      Copy to Clipboard Toggle word wrap

      For more information on the put-bucket-policy command, see the AWS CLI Command Reference for put-bucket-policy.

      Note

      The principal element specifies the user that is allowed or denied access to a resource, such as a bucket. Currently, Only NooBaa accounts can be used as principals. In the case of object bucket claims, NooBaa automatically create an account obc-account.<generated bucket name>@noobaa.io.

      Note

      Bucket policy conditions are not supported.

Additional resources

  • There are many available elements for bucket policies with regard to access permissions.
  • For details on these elements and examples of how they can be used to control the access permissions, see AWS Access Policy Language Overview.
  • For more examples of bucket policies, see AWS Bucket Policy Examples.
  • OpenShift Data Foundation version 4.17 introduces the bucket policy elements NotPrincipal, NotAction, and NotResource. For more information on these elements, see IAM JSON policy elements reference.

7.3. Creating a user in the Multicloud Object Gateway
复制链接

Prerequisites

  • A running OpenShift Data Foundation Platform.

  • Download the Multicloud Object Gateway (MCG) command-line interface binary from the customer portal and make it executable.

    Note

    Choose the correct product variant according to your architecture. Available platforms are Linux(x86_64), Windows, and Mac OS.

Procedure

Execute the following command to create an MCG user account: 

noobaa account create <noobaa-account-name> [--allow_bucket_create=true] [--allowed_buckets=[]] [--default_resource=''] [--full_permission=false]
Copy to Clipboard Toggle word wrap
<noobaa-account-name>
Specify the name of the new MCG user account.
--allow_bucket_create
Allows the user to create new buckets.
--allowed_buckets
Sets the user’s allowed bucket list (use commas or multiple flags).
--default_resource
Sets the default resource.The new buckets are created on this default resource (including the future ones).
--full_permission
Allows this account to access all existing and future buckets.
Important

You need to provide permission to access atleast one bucket or full permission to access all the buckets.

返回顶部
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2025 Red Hat