diff --git a/S3-Configuration.md b/S3-Configuration.md index 53950d2..7b35979 100644 --- a/S3-Configuration.md +++ b/S3-Configuration.md @@ -271,7 +271,15 @@ If you don't need IAM API functionality, you can disable it: weed s3 -iam=false -filer=localhost:8888 ``` -See [[Amazon IAM API]] for detailed IAM usage. +See [[Amazon IAM API]] for detailed IAM usage, or use the [[weed shell]] commands for interactive management: + +```bash +weed shell +> s3.user.create -name alice +> s3.policy -put -name my-policy -file policy.json +> s3.policy.attach -policy my-policy -user alice +> s3.config.show +``` --- diff --git a/S3-Credentials.md b/S3-Credentials.md index c4b6f27..b2a88ec 100644 --- a/S3-Credentials.md +++ b/S3-Credentials.md @@ -285,8 +285,13 @@ Bucket-specific permissions work with all configuration methods: #### Dynamic Configuration (weed shell) ```bash -# Create user with access to specific bucket -s3.configure -access_key=bucket1user -secret_key=bucket1pass -buckets=mybucket -user=bucket1_user -actions=Read,Write,List,Tagging,Admin -apply +# One-step: create user with a readwrite policy for a specific bucket +s3.user.provision -name bucket1_user -bucket mybucket -role readwrite + +# Or step-by-step: +s3.user.create -name bucket1_user +s3.policy -put -name mybucket-policy -file mybucket-policy.json +s3.policy.attach -policy mybucket-policy -user bucket1_user ``` #### Static Configuration File @@ -380,7 +385,8 @@ Filer-based configurations automatically reload when changes are detected: ```bash # Changes are automatically applied weed shell -> s3.configure -user=newuser -access_key=key123 -secret_key=secret123 -actions=Admin -apply +> s3.user.create -name newuser +> s3.policy.attach -policy admin-policy -user newuser ``` The server will automatically detect and apply changes: @@ -448,9 +454,15 @@ weed shell Check current configuration: ```bash -# View current identities (if using filer store) +# View current IAM configuration summary weed shell -> s3.configure -list +> s3.config.show + +# List all users +> s3.user.list + +# Export full configuration as JSON +> s3.iam.export ``` Test credentials: diff --git a/_Sidebar.md b/_Sidebar.md index bbbb0cd..added20 100644 --- a/_Sidebar.md +++ b/_Sidebar.md @@ -102,6 +102,7 @@ * [[S3 Bucket Policies]] * [[Amazon IAM API]] * [[AWS IAM CLI]] +* [[weed shell]] - Shell IAM Commands ### Server-Side Encryption * [[Server-Side Encryption]] diff --git a/weed-shell.md b/weed-shell.md index d1462be..f038507 100644 --- a/weed-shell.md +++ b/weed-shell.md @@ -52,7 +52,13 @@ Type: "help " for help on . Most commands support " - remote.mount.buckets # mount all buckets in remote storage and pull its metadata remote.uncache # keep the metadata but remote cache the file content for mounted directories or files remote.unmount # unmount remote storage - s3.bucket.access # view or set per-bucket access for a user + s3.accesskey.create # create an additional access key for an S3 IAM user + s3.accesskey.delete # delete an access key from an S3 IAM user + s3.accesskey.list # list access keys for an S3 IAM user + s3.accesskey.rotate # rotate an access key for an S3 IAM user + s3.anonymous.get # show anonymous access for a bucket + s3.anonymous.list # list all buckets with anonymous access + s3.anonymous.set # set anonymous (public) access on a bucket s3.bucket.create # create a bucket with a given name s3.bucket.delete # delete a bucket by a given name s3.bucket.list # list all buckets @@ -62,8 +68,23 @@ Type: "help " for help on . Most commands support " - s3.bucket.quota.enforce # check quota for all buckets, make the bucket read only if over the limit s3.circuitBreaker # configure and apply s3 circuit breaker options for each bucket s3.clean.uploads # clean up stale multipart uploads - s3.configure # configure and apply s3 options for each bucket + s3.config.show # show a summary of the current S3 IAM configuration + s3.iam.export # export the full S3 IAM configuration as JSON + s3.iam.import # import S3 IAM configuration from a JSON file s3.policy # manage s3 policies + s3.policy.attach # attach a policy to an S3 IAM user + s3.policy.detach # detach a policy from an S3 IAM user + s3.serviceaccount.create # create a service account for an S3 IAM user + s3.serviceaccount.delete # delete a service account + s3.serviceaccount.list # list service accounts + s3.serviceaccount.show # show details of a service account + s3.user.create # create an S3 IAM user + s3.user.delete # delete an S3 IAM user + s3.user.disable # disable an S3 IAM user + s3.user.enable # enable a disabled S3 IAM user + s3.user.list # list S3 IAM users + s3.user.provision # create a user with a bucket policy in one step + s3.user.show # show details of an S3 IAM user s3tables.bucket # manage s3tables table buckets s3tables.namespace # manage s3tables namespaces s3tables.table # manage s3tables tables @@ -213,6 +234,72 @@ verified 53218 files, error 0 files In this case, you need a local incremental backup via [asynchronous replication](https://github.com/seaweedfs/seaweedfs/wiki/Async-Backup). +# S3 IAM Management + +The shell provides a set of composable commands for managing S3 users, policies, credentials, service accounts, and anonymous access. + +### Common workflow: create a user with a bucket policy + +``` +> s3.policy -put -name=photos-rw -file=photos-policy.json +> s3.user.create -name alice +Created user "alice" +Access Key: AKID... +Secret Key: ... + +> s3.policy.attach -policy photos-rw -user alice +Attached policy "photos-rw" to user "alice" +``` + +Or use the one-step convenience command: +``` +> s3.user.provision -name alice -bucket photos -role readwrite +Created policy "photos-alice-readwrite" +Created user "alice" with policy "photos-alice-readwrite" attached + +Access Key: AKID... +Secret Key: ... +``` + +### Manage credentials +``` +> s3.accesskey.create -user alice +> s3.accesskey.list -user alice +> s3.accesskey.rotate -user alice -access_key AKID... +> s3.accesskey.delete -user alice -access_key AKID... +``` + +### Manage anonymous (public) bucket access +``` +> s3.anonymous.set -bucket photos -access Read,List +> s3.anonymous.get -bucket photos +> s3.anonymous.list +``` + +### Manage service accounts +``` +> s3.serviceaccount.create -user alice -description "CI pipeline" -actions Read,List +> s3.serviceaccount.list -user alice +> s3.serviceaccount.show -id sa-xxxxx +> s3.serviceaccount.delete -id sa-xxxxx +``` + +### User lifecycle +``` +> s3.user.list +> s3.user.show -name alice +> s3.user.disable -name alice +> s3.user.enable -name alice +> s3.user.delete -name alice +``` + +### Backup and restore IAM state +``` +> s3.iam.export -file iam-backup.json +> s3.iam.import -file iam-backup.json +> s3.config.show +``` + # One more trick You can skip the "fs." prefix, for all "fs.*" commands: ```