Grant per-bucket access to SubUsers

A Bucket Policy lets you give each SubUser access to only the buckets it needs. Use it because a SubUser role applies to every bucket in the account: a SubUser with the Read role can read all of your buckets.

For example, you have three buckets, bucket-1, bucket-2, and bucket-3, and want each of three SubUsers to access only one of them.

Prerequisites

• An FPT Cloud account with Object Storage enabled, on a cluster other than HCM-04. On HCM-04, use IAM Users instead.
• The buckets, created in the same region.

Grant access

1. Create each SubUser with the None role, so that it cannot access any bucket by default. See Manage SubUsers.

2. For each bucket, add a Bucket Policy that allows the SubUser to use that bucket. See Configure a Bucket Policy.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": ["arn:aws:iam::SUBUSER_ACCOUNT_ID:user/SUBUSER_NAME"]
         },
         "Action": "s3:*",
         "Resource": [
           "arn:aws:s3:::YOUR_BUCKET_NAME",
           "arn:aws:s3:::YOUR_BUCKET_NAME/*"
         ]
       }
     ]
   }

   Field	Meaning
   Version	The policy language version, usually 2012-10-17.
   Effect	Allow or Deny.
   Principal	The SubUser that receives access. Replace SUBUSER_ACCOUNT_ID and SUBUSER_NAME with its details.
   Action	The allowed actions. s3:* allows all actions; list specific actions such as s3:GetObject to grant less.
   Resource	The bucket and all objects in it.

3. Create an Access Key for each SubUser and give it to the person or application that uses it.

Each SubUser can now access only the bucket whose policy names it.