minio/Bucket-Policy.md

## Access Policy

This package implements parsing and validating bucket access policies based on Access Policy Language specification - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html

### Supports following effects.

    Allow
    Deny

### Supports following set of operations.

    s3:GetObject
    s3:ListBucket
    s3:PutObject
    s3:GetBucketLocation
    s3:DeleteObject
    s3:AbortMultipartUpload
    s3:ListBucketMultipartUploads
    s3:ListMultipartUploadParts

### Supports following conditions.

    StringEquals
    StringNotEquals

Supported applicable condition keys for each conditions.

    s3:prefix
    s3:max-keys

### Nested policy support.

Nested policies are not allowed.
accessPolicy: Implement Put, Get, Delete access policy. This patch implements Get,Put,Delete bucket policies Supporting - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html Currently supports following actions. "": true, "s3:": true, "s3:GetObject": true, "s3:ListBucket": true, "s3:PutObject": true, "s3:CreateBucket": true, "s3:GetBucketLocation": true, "s3:DeleteBucket": true, "s3:DeleteObject": true, "s3:AbortMultipartUpload": true, "s3:ListBucketMultipartUploads": true, "s3:ListMultipartUploadParts": true, following conditions for "StringEquals" and "StringNotEquals" "s3:prefix", "s3:max-keys" 2016-02-04 01:46:56 +01:00			`## Access Policy`

			`This package implements parsing and validating bucket access policies based on Access Policy Language specification - http://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html`

			`### Supports following effects.`

			`Allow`
			`Deny`

			`### Supports following set of operations.`

			`s3:GetObject`
			`s3:ListBucket`
			`s3:PutObject`
			`s3:GetBucketLocation`
			`s3:DeleteObject`
			`s3:AbortMultipartUpload`
			`s3:ListBucketMultipartUploads`
			`s3:ListMultipartUploadParts`

			`### Supports following conditions.`

			`StringEquals`
			`StringNotEquals`

			`Supported applicable condition keys for each conditions.`

			`s3:prefix`
			`s3:max-keys`
bucketpolicy: Improve bucket policy validation, avoid nested rules. Bucket policy validation is more stricter now, to avoid nested rules. The reason to do this is keep the rules simpler and more meaningful avoiding conflicts. This patch implements stricter checks. Example policy to be generally avoided. ``` { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:GetObject", "s3:DeleteObject" ], "Effect": "Allow", "Principal": { "AWS": [ "" ] }, "Resource": [ "arn:aws:s3:::jarjarbing/" ] }, { "Action": [ "s3:GetObject", "s3:DeleteObject" ], "Effect": "Deny", "Principal": { "AWS": [ "" ] }, "Resource": [ "arn:aws:s3:::jarjarbing/restic/key/" ] } ] } ``` 2016-03-15 18:38:04 +01:00
			`### Nested policy support.`

			`Nested policies are not allowed.`