cloudscaleKnowledge Base

To set up read-only access to your bucket (e.g. "my-bucket") for a person or application, create an additional objects user via the control panel or API and make note of the displayed user ID (e.g. "11111111...88888888"). Then create a file as follows and save it locally, e.g. under policy.json:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"AWS": "arn:aws:iam:::user/1111111122222222333333334444444455555555666666667777777788888888"},
    "Action": ["s3:ListBucket","s3:GetObject"],
    "Resource": [
      "arn:aws:s3:::my-bucket",
      "arn:aws:s3:::my-bucket/*"
    ]
  }]
}

Now add this policy to your bucket by means of e.g. the s3cmd tool:

s3cmd setpolicy policy.json s3://my-bucket

The additional objects user can now use their own credentials (access key and secret key) to list and read the objects in "my-bucket", but cannot change or delete them.

Note: For an objects user which will be used in the periodic audit log export, the following permissions are required as a minimum:

"Action": ["s3:PutObject", "s3:GetBucketLocation"],
"Resource": ["arn:aws:s3:::my-bucket","arn:aws:s3:::my-bucket/*"]