Bucket Policies

Overview

Bucket policies control access to your buckets. There are two primary ways to manage these permissions:

1. Predefined Anonymous Access Policies: For common scenarios involving anonymous (public) access, you can use simple, keyword-based policies like public, download, upload, or none using the mc anonymous set <policy-name> <ALIAS> command. These are convenient for setting broad access levels for unauthenticated users. These policies are sometimes called "canned policies".

2. JSON-Based Policies: For more granular control, including granting specific permissions to other authenticated Object Storage users or defining complex access rules, you will use JSON-formatted policies applied with the mc anonymous set-json <policy-file.json> <ALIAS> command. These offer a powerful way to define precisely who can perform what actions on your bucket and its objects.

The following sections show how to use both types.

Usage

Managing anonymous access with predefined policies

This section shows how to use predefined anonymous access policies.

Assume the following user:

• john with UUID f481b360-7ffe-44b7-8998-67cb83dc3c0b

To allow anonymous access to a bucket, you can run the following command:

mc anonymous set public john/johns-private-bucket

This allows anonymous access to the bucket johns-private-bucket.

Valid policies include:

• public - allows anonymous access to the bucket
• download - allows anonymous access to the bucket for downloading objects
• upload - allows anonymous access to the bucket for uploading objects
• none - removes the anonymous access policy from the bucket, effectively making it private again. Note that JSON bucket policies may still grant access to authenticated Object Storage users.

Managing access with JSON-based policies

This section shows how to use JSON-based policies for more granular control, such as granting access to specific authenticated users.

Grant another user access to a bucket by creating a JSON bucket policy. The following example uses two users:

• john with UUID f481b360-7ffe-44b7-8998-67cb83dc3c0b — your current user
• jane with UUID 33c4de8e-ffa0-44c6-a7ac-6c0719fee0b2 — the user you want to allow access to the bucket

First, create a bucket johns-private-bucket.

mc mb john/johns-private-bucket

Then, create a bucket policy that allows jane to access user john's bucket johns-private-bucket. Save the policy as policy.json:

{
  "Version": "2012-10-17",
  "Id": "S3Policy1",
  "Statement": [
    {
      "Sid": "BucketAllow",
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam:::user/33c4de8e-ffa0-44c6-a7ac-6c0719fee0b2"]
      },
      "Action": ["s3:ListBucket", "s3:PutObject", "s3:GetObject"],
      "Resource": [
        "arn:aws:s3:::johns-private-bucket",
        "arn:aws:s3:::johns-private-bucket/*"
      ]
    }
  ]
}

Now, apply the policy to the bucket.

mc anonymous set-json policy.json john/johns-private-bucket

Now jane can access john's bucket johns-private-bucket:

mc ls jane/johns-private-bucket

List the applied policy:

mc anonymous get-json john/johns-private-bucket

To remove the policy, apply an empty policy to the bucket. Save the following to policy.json (or a new file):

{
  "Version": "2012-10-17",
  "Id": "S3Policy1",
  "Statement": []
}

Then apply it:

mc anonymous set-json policy.json john/johns-private-bucket

Verify the policy removal:

mc ls jane/johns-private-bucket
mc: <ERROR> Unable to list folder. Access Denied.

Considerations

Bucket ownership

When uploading files to a bucket, the uploader becomes the owner of the uploaded files. Restrict this by requiring the bucket-owner-full-control permission with the following bucket policy statement:

{
  "Sid": "AllowPutIfBucketOwnerFullControl",
  "Effect": "Allow",
  "Principal": "*", // Or specify the uploader principal
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::your-bucket-name/*",
  "Condition": {
    "StringEquals": {
      "s3:x-amz-acl": "bucket-owner-full-control"
    }
  }
}

This requires clients to include the x-amz-acl: bucket-owner-full-control header when uploading files. With mc, upload files with the required permission:

mc cp --attr "x-amz-acl:bucket-owner-full-control" file.txt jane/johns-private-bucket

ACLs and Bucket Policies

Our Object Storage supports ACLs, but we recommend using bucket policies for access control instead.

Supported Actions

For an overview of the policy actions supported by Object Storage, see the Ceph radosgw bucket policy documentation. We do not support AWS IAM policies on radosgw users, groups or roles.