Comments (7)
It looks like I need to create specific, dedicated users for this - because only users (not roles) can have long-living access key / secret credentials according to the FAQ at https://aws.amazon.com/iam/faqs/
from s3-credentials.
So if I want to create a bucket called my-bucket
and get back an access key and secret that can read/write to that bucket it looks like the steps are:
- Create the bucket
- Create a dedicated user. Usernames can contain any ASCII characters and only need to be unique within that AWS account, so I'm going to default to
s3:read-write:my-bucket
- Attach a policy to that user which says they can perform
s3:*
againstarn:aws:s3:::mybucket/*
(not sure if I can attach policies directly to users or if I have to attach them to a group and put the user in that group) - Create a new access key for that user
Need to do all of this using boto3
.
from s3-credentials.
CLI design:
s3-credentials create-for my-bucket
(I considered s3-credentials create
but I think I like create-for
better, it feels more readable)
This creates credentials for the specified bucket.
s3-credentials whoami
This outputs the result of iam.get_user()["User"]
- just because it feels useful.
from s3-credentials.
How should the root credentials be passed?
I'm going to mostly leave this up to boto3
, which defaults to looking for environment variables or a ~/.aws/config
file according to https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html#configuring-credentials
But I will also support --access-key=xxx --access-secret=yyy
.
from s3-credentials.
Some boto3
notes from my Jupyter notebook:
import boto3
s3 = boto3.resource("s3")
# Creating a bucket in a region
bucket = s3.create_bucket(
Bucket="simonw-s3-credentials-test",
CreateBucketConfiguration={"LocationConstraint": "us-west-1"}
)
# Listing all buckets
for b in s3.buckets.all():
print(b)
# Listing all access keys
iam = boto3.client("iam")
paginator = iam.get_paginator("list_access_keys")
for response in paginator.paginate():
print(response)
from s3-credentials.
iam.create_user()
is the method for creating a new user.
From the docstring:
response = client.create_user(
Path='string',
UserName='string',
PermissionsBoundary='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
Having an option to add tags - maybe --user-tag key value
- feels useful.
That PermissionsBoundary
thing is an interesting option. The docstring just says:
The ARN of the policy that is used to set the permissions boundary for the user.
Not particularly informative! But then I tracked down the documentation here:
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html
This is a little more useful:
AWS supports permissions boundaries for IAM entities (users or roles). A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. An entity's permissions boundary allows it to perform only the actions that are allowed by both its identity-based policies and its permissions boundaries.
[...]
When you use a policy to set the permissions boundary for a user, it limits the user's permissions but does not provide permissions on its own. In this example, the policy sets the maximum permissions of
ShirleyRodriguez
as all operations in Amazon S3, CloudWatch, and Amazon EC2. Shirley can never perform operations in any other service, including IAM, even if she has a permissions policy that allows it.
I rather like the sound of this: being able to restrict these created user accounts to ONLY be able to operate within S3 seems like a great added defense in depth.
One catch: what format should these strings be?
GitHub code search showed me some examples, and also lead me to this file which looks like a list of default available policy ARNs: https://github.com/daviddawha/ArchivesSpaceDevUNR/blob/488b5b83f9ac66a6013e9a0a02d25734886dee02/gems/gems/fog-aws-2.0.0/lib/fog/aws/iam/default_policy_versions.json
Short version: it looks like the two magic strings I care about for this application are:
arn:aws:iam::aws:policy/AmazonS3FullAccess
arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
I'm going to apply these to created users by default, and offer a --user-permissions-boundary none
option for not adding one.
from s3-credentials.
Further research is happening in other issues now.
from s3-credentials.
Related Issues (20)
- Way to make an existing bucket public or private HOT 1
- Convert README into documentation website HOT 3
- Make it easier to add extra policy statements HOT 10
- Provide a `--profile` option to allow AWS profile selection HOT 3
- Using --policy should imply --user-permissions-boundary=none HOT 2
- s3-credentials.AmazonS3FullAccess has MaxSessionDuration 3600, should be 12 hours HOT 5
- KeyError if listing bucket with no items returned
- s3-credentials list-buckets --details should show region and website URL, if configured HOT 2
- `s3-credentials get-objects` command HOT 7
- `get-objects/put-objects` `--skip` and `--skip-hash` options HOT 1
- Add the options to add tags to the created resources HOT 3
- `set-public-policy` command HOT 5
- Add s3:PutObjectAcl to write policies HOT 3
- `s3-credentials delete-objects` command HOT 11
- Mysterious test failure in `test_put_objects` HOT 4
- debug-bucket command HOT 2
- Command to make a bucket public HOT 4
- `s3-credentials create name-of-bucket --create-bucket --public` fails with error HOT 4
- `s3-credentials list-bucket --urls` option HOT 1
- CI failures, including ImportError: cannot import name 'mock_s3' from 'moto' HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from s3-credentials.