Skip to main content

Configure access control on S3 storage with AWS CLI and S3cmd

CDB Object Storage access control uses two mechanisms: ACLs for object and bucket-level permissions, and JSON policies for more granular rules. Both are configured through AWS CLI or S3cmd.

ACLs

ACLs (Access Control Lists) define who can access objects and what operations they can perform. They protect stored data by controlling read, write, and delete permissions at the object and bucket level.

The storage owner configures ACLs using AWS CLI or S3cmd commands.

The following ACL flags are available for AWS CLI (aws s3api put-object-acl or put-bucket-acl) and S3cmd (s3cmd setacl):

AWS CLIS3cmdDescription
--public-read--acl-publicMaking an object publicly accessible
--private--acl-privateMaking an object private
--grant-full-control--acl-grant=full-controlGranting full control over the bucket
--grant-read--acl-grant=readAllowing the listing of objects in the bucket
--grant-read-acp--acl-grant=read_acpAllowing the reading of ACLs
--grant-write--acl-grant=writeAllowing recording, overwriting, and deleting of objects

Policies

Policies are JSON documents that define access rules at a granular level — specifying which actions a user or all users can perform on objects and buckets. The maximum policy size is 20 KB.

The storage owner configures policies. The AWS reference lists all supported S3 actions, conditions, and resource types.

Configure access via ACLs and policies

All commands use AWS CLI and S3cmd interchangeably — choose whichever is already configured on the system.

In all commands and JSON files, replace the following placeholders:

  • sample.jpg — the object name.
  • my_bucket — the bucket name.
  • s-ed1.cloud.gcore.lu — the storage hostname from the Details dialog; the service URLs reference lists all location endpoints.

Public object access via ACL

To allow all users to download an object, apply the public-read ACL (--acl public-read in AWS CLI or --acl-public in S3cmd).

AWS CLI:

aws s3api put-object-acl --bucket my_bucket --key sample.jpg --acl public-read --endpoint-url=https://s-ed1.cloud.gcore.lu

S3cmd:

s3cmd setacl s3://my_bucket/sample.jpg --acl-public

The specified object becomes publicly accessible to all users.

Bucket listing via ACL

To allow all users to list objects in a bucket, apply the public-read ACL to the bucket.

AWS CLI:

aws s3api put-bucket-acl --bucket my_bucket --acl public-read --endpoint-url=https://s-ed1.cloud.gcore.lu

S3cmd:

s3cmd setacl s3://my_bucket/ --acl-grant=read

Users can list objects in the bucket but cannot read or write individual objects without additional object-level ACLs.

Public object access via policy

  1. 1

    Create the policy file

    Create a JSON file with the following policy:

    {
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my_bucket/*"
    }
  ]
}
  2. 2

    Apply the policy

    Apply the policy to the bucket.

    AWS CLI:

    aws s3api put-bucket-policy --policy file://policy.json --endpoint-url=https://s-ed1.cloud.gcore.lu --bucket my_bucket

    S3cmd:

    s3cmd setpolicy policy.json s3://my_bucket/

    All objects in the bucket become publicly accessible for download.

    This policy grants direct file access but does not allow listing the files in the bucket.

Directory access denial via policy

  1. 1

    Create the policy file

    Create a JSON file that allows public read on the bucket but denies access to the secret/ directory:

    {
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my_bucket/*"
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my_bucket/secret/*"
    }
  ]
}
  2. 2

    Apply the policy

    Apply the policy to the bucket.

    AWS CLI:

    aws s3api put-bucket-policy --policy file://policy.json --endpoint-url=https://s-ed1.cloud.gcore.lu --bucket my_bucket

    S3cmd:

    s3cmd setpolicy policy.json s3://my_bucket/

IP-based access via policy

A bucket policy can also limit anonymous access by source IP address or CIDR range. Use a positive Allow statement with an IpAddress condition, because Deny with NotIpAddress does not restrict traffic on CDB Object Storage.

These conditions apply to anonymous requests, while authenticated owner credentials retain their normal permissions.

Keep bucket and object ACLs private, and do not combine this policy with another statement that grants broader anonymous access. s3:* grants every S3 operation from the permitted source, including writes and deletes.

Replace the example IP addresses with the source IPs that should be allowed. The condition matches the client address seen by Object Storage for virtual-hosted and path-style requests, so a client-supplied X-Forwarded-For header cannot bypass the restriction.

  1. 1

    Create the policy file

    Create a JSON file using one of the following patterns.

    Grant every S3 operation from one IPv4 address:

    {
  "Statement": [
    {
      "Sid": "IPAllow",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my_bucket",
        "arn:aws:s3:::my_bucket/*"
      ],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.10/32"
        }
      }
    }
  ]
}

    To allow the same operations from two IPv4 addresses, list both in aws:SourceIp:

    {
  "Statement": [
    {
      "Sid": "IPAllow",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my_bucket",
        "arn:aws:s3:::my_bucket/*"
      ],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "203.0.113.10/32",
            "203.0.113.20/32"
          ]
        }
      }
    }
  ]
}

    Grant the same operations from two CIDR networks:

    {
  "Statement": [
    {
      "Sid": "NetworkAllow",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my_bucket",
        "arn:aws:s3:::my_bucket/*"
      ],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "192.0.2.0/24",
            "198.51.100.0/24"
          ]
        }
      }
    }
  ]
}

    Allow anonymous object downloads from one IPv4 address, while ListBucket and writes remain denied:

    {
  "Statement": [
    {
      "Sid": "IPAllowGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my_bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.10/32"
        }
      }
    }
  ]
}
  2. 2

    Apply the policy

    Apply the policy to the bucket.

    AWS CLI:

    aws s3api put-bucket-policy --policy file://policy.json --endpoint-url=https://s-ed1.cloud.gcore.lu --bucket my_bucket

    S3cmd:

    s3cmd setpolicy policy.json s3://my_bucket/

    Requests from an allowed source return HTTP 200, while requests from any other source return HTTP 403.

Referrer-based access via policy

  1. 1

    Create the policy file

    Create a JSON file that restricts access to requests originating from specific websites. Replace http://www.example.com/ and http://example.com/ with the actual URLs:

    {
  "Statement": [
    {
      "Sid": "Allow get requests originating from www.example.com and example.com.",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject", "s3:GetObjectVersion"],
      "Resource": "arn:aws:s3:::my_bucket/*",
      "Condition": {
        "StringLike": {"aws:Referer": ["http://www.example.com/*", "http://example.com/*"]}
      }
    }
  ]
}
  2. 2

    Apply the policy

    Apply the policy to the bucket.

    AWS CLI:

    aws s3api put-bucket-policy --policy file://policy.json --endpoint-url=https://s-ed1.cloud.gcore.lu --bucket my_bucket

    S3cmd:

    s3cmd setpolicy policy.json s3://my_bucket/

User access grant via policy

  1. 1

    Create the policy file

    Create a JSON file that grants a specific user read and list access. Replace 1234-test with the storage username from the Details dialog:

    {
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam:::user/1234-test"]
      },
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::my_bucket/*", "arn:aws:s3:::my_bucket"]
    }
  ]
}
  2. 2

    Apply the policy

    Apply the policy to the bucket.

    AWS CLI:

    aws s3api put-bucket-policy --policy file://policy.json --endpoint-url=https://s-ed1.cloud.gcore.lu --bucket my_bucket

    S3cmd:

    s3cmd setpolicy policy.json s3://my_bucket/