Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There's a bucket into which some users may write their data for backup purposes.

They use s3cmd to put new files into their bucket.

I'd like to enforce a non-destruction policy on these buckets - meaning, it should be impossible for users to destroy data, they should only be able to add data.

How can I create a bucket policy that only lets a certain user put a file if it doesn't already exist, and doesn't let him do anything else with the bucket.

share|improve this question
add comment

2 Answers 2

up vote 2 down vote accepted

Consider enabling versioning for the bucket. That way users can change and delete what they want, but no data is never really deleted, except by specific calls to delete old versions. Also, there is the possibility of enabling MFA delete, which means you will need a multi-factor authentication token to be able to permanently delete anything.

share|improve this answer
    
great suggestion, thanks. too bad they don't have support for this feature in their console - you have to code to turn it on (or use some 3rd party explorer). –  Assaf Lavie Apr 15 '12 at 7:16
    
Agreed, this should be in their management console. –  Nakedible Apr 15 '12 at 12:35
add comment

You can use amazons policy generator to easily generate new policies.

http://awspolicygen.s3.amazonaws.com/policygen.html

You can easily give someone permissions to ListBuckets and PutObject only. The problem is that PutObject can also update the objects. I'm not sure of any way that you can separate the two using a policy. As long as your ok with users being able to update and add then the policy is pretty simple.

{
  "Id": "Policy1334428511844",
  "Statement": [
    {
      "Sid": "Stmt1334428508621",
      "Action": [
        "s3:GetObject",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::<bucket>\<folder>",
      "Principal": {
        "AWS": [
          "<account-id>"
        ]
      }
    }

] }

share|improve this answer
1  
That dog won't hunt. The idea is to make it impossible to destroy data. –  Assaf Lavie Apr 15 '12 at 7:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.