As the question asks, what are the minimum required permissions for a locked down s3 IAM user to use django-storages successfully? At the present time I've used something like
{
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListAllMyBuckets"],
"Resource": "arn:aws:s3:::*"
},
{
"Effect": "Allow",
"Action": ["s3:ListBucket",
"s3:GetBucketLocation",
"s3:ListBucketMultipartUploads",
"s3:ListBucketVersions"],
"Resource": "arn:aws:s3:::bucket-name"
},
{
"Effect": "Allow",
"Action": ["s3:*Object*",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload"],
"Resource": "arn:aws:s3:::bucket-name/*"
}
]
}
Which may actually be overkill. Any further ideas?
By default, all Amazon S3 buckets and objects are private. Only the resource owner which is the AWS account that created the bucket can access that bucket. The resource owner can, however, choose to grant access permissions to other resources and users.
You can use the NotPrincipal element of an IAM or S3 bucket policy to limit resource access to a specific set of users. This element allows you to block all users who are not defined in its value array, even if they have an Allow in their own IAM user policies.
Fiver's answer is not enough to run collectstatic
in django-storages
. I used everything @jvc26 did except for s3:ListAllMyBuckets
. I would assume s3:ListBucketVersions
is not needed either.
{
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket",
"s3:GetBucketLocation",
"s3:ListBucketMultipartUploads",
"s3:ListBucketVersions"],
"Resource": "arn:aws:s3:::bucket-name"
},
{
"Effect": "Allow",
"Action": ["s3:*Object*",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload"],
"Resource": "arn:aws:s3:::bucket-name/*"
}
]
}
I'm not 100% sure about django-storages, as I use cuddly-buddly which is based on the S3 portion of django-storages. I just found cuddlybuddly simpler to use and worked better, plus the name is awesome!
Anyway, I have a project using Django+S3 and found the following AWS policy as the minimum required for my project:
{
"Version": "2008-10-17",
"Id": "Policy123",
"Statement": [
{
"Sid": "Stmt123",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::some-aws-user"
},
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::bucket-name"
},
{
"Sid": "Stmt234",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::some-aws-user"
},
"Action": [
"s3:DeleteObject",
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::bucket-name/*"
}
]
}
I have Django views that need to upload, retrieve, and delete so those corresponding actions can be used/omitted based on your needs. Obviously, anyone will need to change the user and bucket name.
Also, just for completeness as it wasn't obvious to me, note the following restrictions regarding AWS policies:
The maximum size of a policy is 20 KB
The value for Resource must be prefixed with the bucket name or the bucket name and a path under it (bucket/). If only the bucket name is specified, without the trailing /, the policy applies to the bucket.
Each policy must have a unique policy ID (Id)
Each statement in a policy must have a unique statement ID (sid)
Each policy must cover only a single bucket and resources within that bucket (when writing a policy, don't include statements that refer to other buckets or resources in other buckets)
Finally, to anyone tempted to do so, don't change the date value in the Version
key, Amazon uses this value to parse the policy format.
Hope this helps!
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With