mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-24 06:50:40 +02:00
docs: update wiki for new S3 IAM shell commands
- weed-shell.md: replace s3.configure and s3.bucket.access in command listing with new commands (s3.user.*, s3.accesskey.*, s3.anonymous.*, s3.serviceaccount.*, s3.policy.attach|detach, s3.iam.*, s3.config.show, s3.user.provision). Add "S3 IAM Management" section with workflow examples. - S3-Credentials.md: update shell examples to use new commands instead of s3.configure. - S3-Configuration.md: add shell command examples to Embedded IAM section. - _Sidebar.md: add weed shell link under S3 Authentication & IAM.
Chris Lu committed
1 parent
fa57a09399
commit
556217ef5b
4 files changed
+116
-8
No files matched your search
+9
-1
@@ -271,7 +271,15 @@ If you don't need IAM API functionality, you can disable it:
|
||||
weed s3 -iam=false -filer=localhost:8888
|
||||
```
|
||||
|
||||
See [[Amazon IAM API]] for detailed IAM usage.
|
||||
See [[Amazon IAM API]] for detailed IAM usage, or use the [[weed shell]] commands for interactive management:
|
||||
|
||||
```bash
|
||||
weed shell
|
||||
> s3.user.create -name alice
|
||||
> s3.policy -put -name my-policy -file policy.json
|
||||
> s3.policy.attach -policy my-policy -user alice
|
||||
> s3.config.show
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
|
||||
+17
-5
@@ -285,8 +285,13 @@ Bucket-specific permissions work with all configuration methods:
|
||||
|
||||
#### Dynamic Configuration (weed shell)
|
||||
```bash
|
||||
# Create user with access to specific bucket
|
||||
s3.configure -access_key=bucket1user -secret_key=bucket1pass -buckets=mybucket -user=bucket1_user -actions=Read,Write,List,Tagging,Admin -apply
|
||||
# One-step: create user with a readwrite policy for a specific bucket
|
||||
s3.user.provision -name bucket1_user -bucket mybucket -role readwrite
|
||||
|
||||
# Or step-by-step:
|
||||
s3.user.create -name bucket1_user
|
||||
s3.policy -put -name mybucket-policy -file mybucket-policy.json
|
||||
s3.policy.attach -policy mybucket-policy -user bucket1_user
|
||||
```
|
||||
|
||||
#### Static Configuration File
|
||||
@@ -380,7 +385,8 @@ Filer-based configurations automatically reload when changes are detected:
|
||||
```bash
|
||||
# Changes are automatically applied
|
||||
weed shell
|
||||
> s3.configure -user=newuser -access_key=key123 -secret_key=secret123 -actions=Admin -apply
|
||||
> s3.user.create -name newuser
|
||||
> s3.policy.attach -policy admin-policy -user newuser
|
||||
```
|
||||
|
||||
The server will automatically detect and apply changes:
|
||||
@@ -448,9 +454,15 @@ weed shell
|
||||
|
||||
Check current configuration:
|
||||
```bash
|
||||
# View current identities (if using filer store)
|
||||
# View current IAM configuration summary
|
||||
weed shell
|
||||
> s3.configure -list
|
||||
> s3.config.show
|
||||
|
||||
# List all users
|
||||
> s3.user.list
|
||||
|
||||
# Export full configuration as JSON
|
||||
> s3.iam.export
|
||||
```
|
||||
|
||||
Test credentials:
|
||||
|
||||
+1
@@ -102,6 +102,7 @@
|
||||
* [[S3 Bucket Policies]]
|
||||
* [[Amazon IAM API]]
|
||||
* [[AWS IAM CLI]]
|
||||
* [[weed shell]] - Shell IAM Commands
|
||||
|
||||
### Server-Side Encryption
|
||||
* [[Server-Side Encryption]]
|
||||
|
||||
+89
-2
@@ -52,7 +52,13 @@ Type: "help <command>" for help on <command>. Most commands support "<command> -
|
||||
remote.mount.buckets # mount all buckets in remote storage and pull its metadata
|
||||
remote.uncache # keep the metadata but remote cache the file content for mounted directories or files
|
||||
remote.unmount # unmount remote storage
|
||||
s3.bucket.access # view or set per-bucket access for a user
|
||||
s3.accesskey.create # create an additional access key for an S3 IAM user
|
||||
s3.accesskey.delete # delete an access key from an S3 IAM user
|
||||
s3.accesskey.list # list access keys for an S3 IAM user
|
||||
s3.accesskey.rotate # rotate an access key for an S3 IAM user
|
||||
s3.anonymous.get # show anonymous access for a bucket
|
||||
s3.anonymous.list # list all buckets with anonymous access
|
||||
s3.anonymous.set # set anonymous (public) access on a bucket
|
||||
s3.bucket.create # create a bucket with a given name
|
||||
s3.bucket.delete # delete a bucket by a given name
|
||||
s3.bucket.list # list all buckets
|
||||
@@ -62,8 +68,23 @@ Type: "help <command>" for help on <command>. Most commands support "<command> -
|
||||
s3.bucket.quota.enforce # check quota for all buckets, make the bucket read only if over the limit
|
||||
s3.circuitBreaker # configure and apply s3 circuit breaker options for each bucket
|
||||
s3.clean.uploads # clean up stale multipart uploads
|
||||
s3.configure # configure and apply s3 options for each bucket
|
||||
s3.config.show # show a summary of the current S3 IAM configuration
|
||||
s3.iam.export # export the full S3 IAM configuration as JSON
|
||||
s3.iam.import # import S3 IAM configuration from a JSON file
|
||||
s3.policy # manage s3 policies
|
||||
s3.policy.attach # attach a policy to an S3 IAM user
|
||||
s3.policy.detach # detach a policy from an S3 IAM user
|
||||
s3.serviceaccount.create # create a service account for an S3 IAM user
|
||||
s3.serviceaccount.delete # delete a service account
|
||||
s3.serviceaccount.list # list service accounts
|
||||
s3.serviceaccount.show # show details of a service account
|
||||
s3.user.create # create an S3 IAM user
|
||||
s3.user.delete # delete an S3 IAM user
|
||||
s3.user.disable # disable an S3 IAM user
|
||||
s3.user.enable # enable a disabled S3 IAM user
|
||||
s3.user.list # list S3 IAM users
|
||||
s3.user.provision # create a user with a bucket policy in one step
|
||||
s3.user.show # show details of an S3 IAM user
|
||||
s3tables.bucket # manage s3tables table buckets
|
||||
s3tables.namespace # manage s3tables namespaces
|
||||
s3tables.table # manage s3tables tables
|
||||
@@ -213,6 +234,72 @@ verified 53218 files, error 0 files
|
||||
|
||||
In this case, you need a local incremental backup via [asynchronous replication](https://github.com/seaweedfs/seaweedfs/wiki/Async-Backup).
|
||||
|
||||
# S3 IAM Management
|
||||
|
||||
The shell provides a set of composable commands for managing S3 users, policies, credentials, service accounts, and anonymous access.
|
||||
|
||||
### Common workflow: create a user with a bucket policy
|
||||
|
||||
```
|
||||
> s3.policy -put -name=photos-rw -file=photos-policy.json
|
||||
> s3.user.create -name alice
|
||||
Created user "alice"
|
||||
Access Key: AKID...
|
||||
Secret Key: ...
|
||||
|
||||
> s3.policy.attach -policy photos-rw -user alice
|
||||
Attached policy "photos-rw" to user "alice"
|
||||
```
|
||||
|
||||
Or use the one-step convenience command:
|
||||
```
|
||||
> s3.user.provision -name alice -bucket photos -role readwrite
|
||||
Created policy "photos-alice-readwrite"
|
||||
Created user "alice" with policy "photos-alice-readwrite" attached
|
||||
|
||||
Access Key: AKID...
|
||||
Secret Key: ...
|
||||
```
|
||||
|
||||
### Manage credentials
|
||||
```
|
||||
> s3.accesskey.create -user alice
|
||||
> s3.accesskey.list -user alice
|
||||
> s3.accesskey.rotate -user alice -access_key AKID...
|
||||
> s3.accesskey.delete -user alice -access_key AKID...
|
||||
```
|
||||
|
||||
### Manage anonymous (public) bucket access
|
||||
```
|
||||
> s3.anonymous.set -bucket photos -access Read,List
|
||||
> s3.anonymous.get -bucket photos
|
||||
> s3.anonymous.list
|
||||
```
|
||||
|
||||
### Manage service accounts
|
||||
```
|
||||
> s3.serviceaccount.create -user alice -description "CI pipeline" -actions Read,List
|
||||
> s3.serviceaccount.list -user alice
|
||||
> s3.serviceaccount.show -id sa-xxxxx
|
||||
> s3.serviceaccount.delete -id sa-xxxxx
|
||||
```
|
||||
|
||||
### User lifecycle
|
||||
```
|
||||
> s3.user.list
|
||||
> s3.user.show -name alice
|
||||
> s3.user.disable -name alice
|
||||
> s3.user.enable -name alice
|
||||
> s3.user.delete -name alice
|
||||
```
|
||||
|
||||
### Backup and restore IAM state
|
||||
```
|
||||
> s3.iam.export -file iam-backup.json
|
||||
> s3.iam.import -file iam-backup.json
|
||||
> s3.config.show
|
||||
```
|
||||
|
||||
# One more trick
|
||||
You can skip the "fs." prefix, for all "fs.*" commands:
|
||||
```
|
||||
|
||||
Reference in new issue
Block a user