Comments (10)
One option would be to support multiple --statement
options, each of which can be either a chunk of JSON or some kind of shortcut that indicates one of a number of pre-baked patterns.
Could support --statement textract:all
or --statement textract:async
as shortcuts.
from s3-credentials.
I need a better feeling for what other kinds of shortcuts might be useful.
from s3-credentials.
https://aws.amazon.com/blogs/security/back-to-school-understanding-the-iam-policy-grammar/ says:
There are five core types of elements that you can use in your policy. Some are required and some are optional. Let's walk through them.
Effect
(Required) -- specifies whether the statement will explicitly allow ("Allow") or deny ("Deny") access. These are the only two values that are valid in this element.Action
* (Required) -- describes the type of access that should be allowed or denied.Resource
* (Required) -- specifies the object or objects that the statement covers.Principal
* (Optional) -- specifies the user, account, service, or other entity that is allowed or denied access to a resource. Principals can only be used for resource-based policies. For policies within IAM, the policy is attached to the Principal it applies to.Condition
(Optional) -- lets you specify conditions for when a policy is in effect.
So Effect, Action and Resource are required.
from s3-credentials.
I'm tempted to say that --statement action:name-of-action
is a shortcut for adding a Effect: Allow, Action: Action, Resource: *
statement.
from s3-credentials.
I have a full list (I think) of potential actions here: https://iam-definitions.vercel.app/iam/privileges
from s3-credentials.
Alternative design: --allow-action 'textract:*'
which would add this:
[
{
"Effect": "Allow",
"Action": ["textract:*"],
"Resource": "*"
}
]
But given that, what would the shortcut be if you didn't want to use "Resource": "*"
?
Maybe --allow-action-on-resource <action> <resource>
could be supported too?
from s3-credentials.
I'm just going to implement --statement <json>
which takes the full block of JSON and --allow-action <action>
which adds an allow block on resource * for that specified action.
If you pass --allow-action
multiple times they will all be bundled in the same statement.
I'm not going to implement shortcut templates, because I don't have a good idea for what they should be - and textract:*
is a good enough solution for the moment.
from s3-credentials.
Updated documentation:
- https://github.com/simonw/s3-credentials/blob/54f810acfc16e52323c7229ef950ede85df47f3b/README.md#using-a-custom-policy
- https://github.com/simonw/s3-credentials/blob/54f810acfc16e52323c7229ef950ede85df47f3b/README.md#policy
- https://github.com/simonw/s3-credentials/blob/54f810acfc16e52323c7229ef950ede85df47f3b/help.md#s3-credentials-create---help
- https://github.com/simonw/s3-credentials/blob/54f810acfc16e52323c7229ef950ede85df47f3b/help.md#s3-credentials-policy---help
from s3-credentials.
I decided to just implement --statement
for the moment, and not to implement that --allow-action
idea.
from s3-credentials.
I tested this like so and it worked:
s3-credentials create simonw-ocr-demo-bucket --statement '{
"Effect": "Allow",
"Action": "textract:*",
"Resource": "*"
}' -c > ocr.json
Then tested like so:
s3-credentials put-object simonw-ocr-demo-bucket github-octoverse-2020-community-report.pdf ~/Downloads/2020-reports/github-octoverse-2020-community-report.pdf -a ocr.json
s3-ocr start simonw-ocr-demo-bucket -a ocr.json --all
s3-ocr status simonw-ocr-demo-bucket -a ocr.json
s3-ocr index simonw-ocr-demo-bucket /tmp/github-index.db -a ocr.json
datasette /tmp/github-index.db -p 8525
from s3-credentials.
Related Issues (20)
- Way to make an existing bucket public or private HOT 1
- Convert README into documentation website HOT 3
- Provide a `--profile` option to allow AWS profile selection HOT 3
- Using --policy should imply --user-permissions-boundary=none HOT 2
- s3-credentials.AmazonS3FullAccess has MaxSessionDuration 3600, should be 12 hours HOT 5
- KeyError if listing bucket with no items returned
- s3-credentials list-buckets --details should show region and website URL, if configured HOT 2
- `s3-credentials get-objects` command HOT 7
- `get-objects/put-objects` `--skip` and `--skip-hash` options HOT 1
- Add the options to add tags to the created resources HOT 3
- `set-public-policy` command HOT 5
- Add s3:PutObjectAcl to write policies HOT 3
- `s3-credentials delete-objects` command HOT 11
- Mysterious test failure in `test_put_objects` HOT 4
- debug-bucket command HOT 3
- Command to make a bucket public HOT 4
- `s3-credentials create name-of-bucket --create-bucket --public` fails with error HOT 4
- `s3-credentials list-bucket --urls` option HOT 1
- CI failures, including ImportError: cannot import name 'mock_s3' from 'moto' HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from s3-credentials.