From 1d4070befe71d19360ab51137a951229b8a1a9fb Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 25 Feb 2026 13:38:33 -0800 Subject: [PATCH] Document multipart upload permission inheritance in S3 policies Added new section 'Multipart Upload Permission Inheritance' explaining how granting s3:PutObject implicitly allows all multipart upload operations (CreateMultipartUpload, UploadPart, CompleteMultipartUpload, AbortMultipartUpload, ListBucketMultipartUploads, ListMultipartUploadParts). This aligns with AWS S3 semantics where multipart upload is an implementation detail of s3:PutObject. --- S3-Bucket-Policies.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/S3-Bucket-Policies.md b/S3-Bucket-Policies.md index 1afae62..148f736 100644 --- a/S3-Bucket-Policies.md +++ b/S3-Bucket-Policies.md @@ -246,10 +246,25 @@ Common actions in bucket policies: - **Object Operations**: `s3:GetObject`, `s3:PutObject`, `s3:DeleteObject` - **Bucket Operations**: `s3:ListBucket`, `s3:CreateBucket`, `s3:DeleteBucket` - **ACL Operations**: `s3:PutObjectAcl`, `s3:GetObjectAcl` -- **Multipart Operations**: `s3:CreateMultipartUpload`, `s3:UploadPart`, `s3:CompleteMultipartUpload` +- **Multipart Operations**: `s3:CreateMultipartUpload`, `s3:UploadPart`, `s3:CompleteMultipartUpload`, `s3:AbortMultipartUpload`, `s3:ListBucketMultipartUploads`, `s3:ListMultipartUploadParts` - **Object Tagging**: `s3:GetObjectTagging`, `s3:PutObjectTagging` - **Versioning**: `s3:GetObjectVersion`, `s3:PutObjectVersionAcl` +## Multipart Upload Permission Inheritance + +When a policy grants `s3:PutObject`, it implicitly allows all multipart upload operations: + +- `s3:CreateMultipartUpload` - Start a multipart upload +- `s3:UploadPart` - Upload parts of a multipart upload +- `s3:CompleteMultipartUpload` - Complete a multipart upload +- `s3:AbortMultipartUpload` - Abort an incomplete multipart upload +- `s3:ListBucketMultipartUploads` - List in-progress multipart uploads +- `s3:ListMultipartUploadParts` - List parts of a multipart upload + +This behavior aligns with AWS S3 semantics where multipart upload is considered an implementation detail of `s3:PutObject`. Users can upload large objects using either a single direct upload (if `s3:PutObject` is granted) or multiple parts via multipart upload (also allowed by `s3:PutObject`). + +**Example**: A policy granting only `s3:PutObject` is sufficient to perform complete multipart uploads without explicitly listing all multipart actions. + ## Policy Validation SeaweedFS validates bucket policies for: