EL storage: Restrict User Access to Buckets or Folders via the Wasabi Console
With EL storage, we offer you an unbeatable-value S3-compatible cloud storage solution based on Wasabi Hot Cloud Storage technology.
In our helpdesk articles, we show you how to administer EL storage via the Wasabi Console.
Multiple people often access an EL storage account to store or back up data in the cloud storage. In these cases, you can restrict access to protect personal data from being accessed by other users. Access can be limited to specific users for individual buckets or even individual folders within buckets.
This guide assumes that you already have an EL storage account and have created a bucket or folder within a bucket for which you want to restrict access. If you do not yet have an account, you can get a demo version here.
1. Restricting access at bucket level
First, log in to the Wasabi Web Console using your root account.
In the left-hand menu, navigate to “Policies” and select “CREATE POLICY”.
Give your policy a name and description.
You must then enter the policy content in the policy document. At bucket level, there are two different options:
1. The user has access to the Web Console and should be able to perform operations within it. In this case, however, the user can see the names of all existing buckets. The policy would look as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "arn:aws:s3:::*"
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::Bucketname",
"arn:aws:s3:::Bucketname/*"
]
}
]
}
Replace “Bucketname” with the name of the bucket the user should have access to.
To avoid having to create a separate policy for each user, you can also use the $username variable. In this scenario, make sure that the username and bucket name are identical.
Such a policy would look as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "arn:aws:s3:::*"
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::${aws:username}",
"arn:aws:s3:::${aws:username}/*"
]
}
]
}
2. The user cannot log in to the Web Console but has access via software (backup user, etc.). In this case, the policy would look as follows:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetBucketLocation",
"s3:ListBucketMultipartUploads"
],
"Resource": [
"arn:aws:s3:::Bucket-Name/*",
"arn:aws:s3:::Bucket-Name"
]
},
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::Bucket-Name/*",
"arn:aws:s3:::Bucket-Name"
]
}
]
}
Replace “Bucket-Name” with the name of the bucket the user should have access to.
When using a third-party file explorer, it is possible that the user can still see the names of all buckets. In this case, an additional Explicit Deny policy must be assigned to the user.
It should contain the following:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": [
"s3:ListBucket",
"s3:GetBucketLocation",
"s3:ListBucketMultipartUploads"
],
"NotResource": [
"arn:aws:s3:::Bucket-Name/*",
"arn:aws:s3:::Bucket-Name"
]
},
{
"Effect": "Deny",
"Action": "s3:*",
"NotResource": [
"arn:aws:s3:::Bucket-Name/*",
"arn:aws:s3:::Bucket-Name"
]
}
]
}
Under “Policy Document”, a green check mark should appear after you have customized and inserted the policy, indicating that the policy is correctly formatted. Unfortunately, the German translation in the interface is currently incorrect. Complete the creation by clicking “CREATE POLICY”.
Some file explorers and backup solutions require the s3:ListAllMyBuckets permission in order to access buckets. If this is the case, only the first policy is suitable, and unfortunately it is not possible to hide the bucket names from other users.
2. Restricting access at folder level
Restricting access at folder level also requires a policy for users or groups. Create a policy as described above.
The policy should contain the following:
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AllowUserToSeeBucketListInTheConsole",
"Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::*"]
},
{
"Sid": "AllowRootAndHomeListingOfCompanyBucket",
"Action": ["s3:ListBucket"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::Bucket-Name"],
"Condition":{"StringEquals":{"s3:prefix":["","Folder-Name/"],"s3:delimiter":["/"]}}
},
{
"Sid": "AllowListingOfUserFolder",
"Action": ["s3:ListBucket"],
"Effect": "Allow",
"Resource": ["arn:aws:s3:::Bucket-Name"],
"Condition":{"StringLike":{"s3:prefix":["Folder-Name/*"]}}
},
{
"Sid": "AllowAllS3ActionsInUserFolder",
"Effect": "Allow",
"Action": ["s3:*"],
"Resource": ["arn:aws:s3:::Bucket-Name/Folder-Name/*"]
}
]
}
Replace “Bucket-Name” with the name of the respective bucket and “Folder-Name” with the name of the respective folder within the bucket.
Important: For “Folder-Name”, you can only use folders that actually exist in the bucket specified under “Bucket-Name”.
You now only need to assign the policy to an existing user or create a new user with this policy. You can find instructions for creating a user here.
You can also find further information on this topic in the manufacturer’s documentation here.