1

There's a bucket into which some users may write their data for backup purposes.

They use s3cmd to put new files into their bucket.

I'd like to enforce a non-destruction policy on these buckets - meaning, it should be impossible for users to destroy data, they should only be able to add data.

How can I create a bucket policy that only lets a certain user put a file if it doesn't already exist, and doesn't let him do anything else with the bucket.

2 Answers 2

3

Consider enabling versioning for the bucket. That way users can change and delete what they want, but no data is never really deleted, except by specific calls to delete old versions. Also, there is the possibility of enabling MFA delete, which means you will need a multi-factor authentication token to be able to permanently delete anything.

2
  • great suggestion, thanks. too bad they don't have support for this feature in their console - you have to code to turn it on (or use some 3rd party explorer). Apr 15, 2012 at 7:16
  • Agreed, this should be in their management console.
    – Nakedible
    Apr 15, 2012 at 12:35
0

You can use amazons policy generator to easily generate new policies.

http://awspolicygen.s3.amazonaws.com/policygen.html

You can easily give someone permissions to ListBuckets and PutObject only. The problem is that PutObject can also update the objects. I'm not sure of any way that you can separate the two using a policy. As long as your ok with users being able to update and add then the policy is pretty simple.

{
  "Id": "Policy1334428511844",
  "Statement": [
    {
      "Sid": "Stmt1334428508621",
      "Action": [
        "s3:GetObject",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::<bucket>\<folder>",
      "Principal": {
        "AWS": [
          "<account-id>"
        ]
      }
    }

] }

1
  • 1
    That dog won't hunt. The idea is to make it impossible to destroy data. Apr 15, 2012 at 7:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .