mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-20 13:30:46 +02:00
Update wiki documentation for embedded IAM in S3 server
- Amazon-IAM-API.md: Document that IAM is now embedded in S3 by default, add self-service operations table, update examples for new endpoint - AWS-IAM-CLI.md: Update all examples to use S3 endpoint (port 8333), add self-service key management section, improve workflow examples - S3-Configuration.md: Add section about embedded IAM API
chrislusf
+262
-43
@@ -1,34 +1,107 @@
|
||||
# Installation
|
||||
# AWS IAM CLI with SeaweedFS
|
||||
|
||||
See [AWS-CLI-with-SeaweedFS](https://github.com/seaweedfs/seaweedfs/wiki/AWS-CLI-with-SeaweedFS#installation)
|
||||
This guide shows how to use the AWS CLI to manage IAM users, access keys, and policies in SeaweedFS.
|
||||
|
||||
# Execute commands
|
||||
## Installation
|
||||
|
||||
## Pre-requisite
|
||||
See [AWS-CLI-with-SeaweedFS](https://github.com/seaweedfs/seaweedfs/wiki/AWS-CLI-with-SeaweedFS#installation) for AWS CLI installation instructions.
|
||||
|
||||
* Remove `-s3.config` params
|
||||
* Create an admin through `weed shell`, and use these credentials to access IAM
|
||||
## Prerequisites
|
||||
|
||||
e.g.:
|
||||
```
|
||||
s3.configure -apply -user admin -access_key some_access_key1 -secret_key some_secret_key1 -actions Admin
|
||||
```
|
||||
### 1. Start SeaweedFS with S3/IAM
|
||||
|
||||
## Create S3 credentials
|
||||
|
||||
Make sure you are using the admin:
|
||||
The IAM API is embedded in the S3 server by default:
|
||||
|
||||
```bash
|
||||
export AWS_ACCESS_KEY_ID=some_access_key1
|
||||
export AWS_SECRET_ACCESS_KEY=some_secret_key1
|
||||
# Start with embedded IAM (default)
|
||||
weed s3 -filer=localhost:8888
|
||||
|
||||
# Or with weed server
|
||||
weed server -s3
|
||||
```
|
||||
|
||||
Create user and access key
|
||||
### 2. Create Admin Credentials
|
||||
|
||||
Create an admin user to manage IAM:
|
||||
|
||||
```bash
|
||||
echo 's3.configure -apply -user admin -access_key admin_access_key -secret_key admin_secret_key -actions Admin' | weed shell
|
||||
```
|
||||
aws --endpoint http://127.0.0.1:8111 iam create-access-key --user-name Bob
|
||||
|
||||
### 3. Configure AWS CLI
|
||||
|
||||
Set the endpoint to your S3 server (IAM uses the same endpoint):
|
||||
|
||||
```bash
|
||||
export AWS_ACCESS_KEY_ID=admin_access_key
|
||||
export AWS_SECRET_ACCESS_KEY=admin_secret_key
|
||||
|
||||
# IAM and S3 use the same endpoint
|
||||
export AWS_ENDPOINT=http://localhost:8333
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## User Management
|
||||
|
||||
### Create a User
|
||||
|
||||
```bash
|
||||
aws --endpoint $AWS_ENDPOINT iam create-user --user-name bob
|
||||
```
|
||||
|
||||
Output:
|
||||
```json
|
||||
{
|
||||
"User": {
|
||||
"UserName": "bob"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### List Users
|
||||
|
||||
```bash
|
||||
aws --endpoint $AWS_ENDPOINT iam list-users
|
||||
```
|
||||
|
||||
Output:
|
||||
```json
|
||||
{
|
||||
"Users": [
|
||||
{ "UserName": "admin" },
|
||||
{ "UserName": "bob" }
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### Get User Details
|
||||
|
||||
```bash
|
||||
aws --endpoint $AWS_ENDPOINT iam get-user --user-name bob
|
||||
```
|
||||
|
||||
### Delete User
|
||||
|
||||
```bash
|
||||
aws --endpoint $AWS_ENDPOINT iam delete-user --user-name bob
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Access Key Management
|
||||
|
||||
### Create Access Key
|
||||
|
||||
```bash
|
||||
aws --endpoint $AWS_ENDPOINT iam create-access-key --user-name bob
|
||||
```
|
||||
|
||||
Output:
|
||||
```json
|
||||
{
|
||||
"AccessKey": {
|
||||
"UserName": "Bob",
|
||||
"UserName": "bob",
|
||||
"AccessKeyId": "X8R439UM7OSQJX28I9QTP",
|
||||
"Status": "Active",
|
||||
"SecretAccessKey": "FLh9yeeYhzA7qsiyLIXsvuhv4g2cSgoUJJe/EqZw1z"
|
||||
@@ -36,9 +109,56 @@ aws --endpoint http://127.0.0.1:8111 iam create-access-key --user-name Bob
|
||||
}
|
||||
```
|
||||
|
||||
Create read only access to the bucket
|
||||
### List Access Keys
|
||||
|
||||
```bash
|
||||
aws --endpoint $AWS_ENDPOINT iam list-access-keys --user-name bob
|
||||
```
|
||||
echo '
|
||||
|
||||
Output:
|
||||
```json
|
||||
{
|
||||
"AccessKeyMetadata": [
|
||||
{
|
||||
"UserName": "bob",
|
||||
"AccessKeyId": "X8R439UM7OSQJX28I9QTP",
|
||||
"Status": "Active"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### Delete Access Key
|
||||
|
||||
```bash
|
||||
aws --endpoint $AWS_ENDPOINT iam delete-access-key --user-name bob --access-key-id X8R439UM7OSQJX28I9QTP
|
||||
```
|
||||
|
||||
### Self-Service: Manage Your Own Keys
|
||||
|
||||
Users can manage their own access keys without admin privileges:
|
||||
|
||||
```bash
|
||||
# Set credentials for the user
|
||||
export AWS_ACCESS_KEY_ID=bob_access_key
|
||||
export AWS_SECRET_ACCESS_KEY=bob_secret_key
|
||||
|
||||
# Create a new key for yourself (no --user-name needed)
|
||||
aws --endpoint $AWS_ENDPOINT iam create-access-key
|
||||
|
||||
# List your own keys
|
||||
aws --endpoint $AWS_ENDPOINT iam list-access-keys
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Policy Management
|
||||
|
||||
### Create and Attach a Read-Only Policy
|
||||
|
||||
```bash
|
||||
# Create policy document
|
||||
cat > readonly-policy.json << 'EOF'
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
@@ -49,22 +169,93 @@ echo '
|
||||
"s3:List*"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:s3:::EXAMPLE-BUCKET/*"
|
||||
"arn:aws:s3:::my-bucket",
|
||||
"arn:aws:s3:::my-bucket/*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
' > S3-read-only-example-bucket.policy
|
||||
aws --endpoint http://127.0.0.1:8111 iam put-user-policy --user-name Bob --policy-name ExamplePolicy --policy-document file://S3-read-only-example-bucket.policy
|
||||
EOF
|
||||
|
||||
# Attach to user
|
||||
aws --endpoint $AWS_ENDPOINT iam put-user-policy \
|
||||
--user-name bob \
|
||||
--policy-name ReadOnlyPolicy \
|
||||
--policy-document file://readonly-policy.json
|
||||
```
|
||||
|
||||
Checking
|
||||
### Create Read-Write Policy for Specific Bucket
|
||||
|
||||
```bash
|
||||
cat > readwrite-policy.json << 'EOF'
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:Get*",
|
||||
"s3:Put*",
|
||||
"s3:Delete*",
|
||||
"s3:List*"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:s3:::data-bucket",
|
||||
"arn:aws:s3:::data-bucket/*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
|
||||
aws --endpoint $AWS_ENDPOINT iam put-user-policy \
|
||||
--user-name bob \
|
||||
--policy-name DataBucketAccess \
|
||||
--policy-document file://readwrite-policy.json
|
||||
```
|
||||
|
||||
### Get User Policy
|
||||
|
||||
```bash
|
||||
aws --endpoint $AWS_ENDPOINT iam get-user-policy \
|
||||
--user-name bob \
|
||||
--policy-name ReadOnlyPolicy
|
||||
```
|
||||
|
||||
### Delete User Policy
|
||||
|
||||
```bash
|
||||
aws --endpoint $AWS_ENDPOINT iam delete-user-policy \
|
||||
--user-name bob \
|
||||
--policy-name ReadOnlyPolicy
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Verify Configuration
|
||||
|
||||
Check the current S3/IAM configuration:
|
||||
|
||||
```bash
|
||||
echo 's3.configure' | weed shell
|
||||
```
|
||||
|
||||
Output:
|
||||
```json
|
||||
{
|
||||
"identities": [
|
||||
{
|
||||
"name": "Bob",
|
||||
"name": "admin",
|
||||
"credentials": [
|
||||
{
|
||||
"accessKey": "admin_access_key",
|
||||
"secretKey": "admin_secret_key"
|
||||
}
|
||||
],
|
||||
"actions": ["Admin"]
|
||||
},
|
||||
{
|
||||
"name": "bob",
|
||||
"credentials": [
|
||||
{
|
||||
"accessKey": "X8R439UM7OSQJX28I9QTP",
|
||||
@@ -72,31 +263,59 @@ echo 's3.configure' | weed shell
|
||||
}
|
||||
],
|
||||
"actions": [
|
||||
"Read:EXAMPLE-BUCKET",
|
||||
"List:EXAMPLE-BUCKET"
|
||||
"Read:my-bucket",
|
||||
"List:my-bucket"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Show S3 credentials
|
||||
---
|
||||
|
||||
List access keys
|
||||
```
|
||||
aws --endpoint http://127.0.0.1:8111 iam list-access-keys
|
||||
## Complete Workflow Example
|
||||
|
||||
```bash
|
||||
# 1. Set admin credentials
|
||||
export AWS_ACCESS_KEY_ID=admin_key
|
||||
export AWS_SECRET_ACCESS_KEY=admin_secret
|
||||
export AWS_ENDPOINT=http://localhost:8333
|
||||
|
||||
# 2. Create a new user
|
||||
aws --endpoint $AWS_ENDPOINT iam create-user --user-name alice
|
||||
|
||||
# 3. Create access key for the user
|
||||
aws --endpoint $AWS_ENDPOINT iam create-access-key --user-name alice
|
||||
|
||||
# 4. Create a read-only policy
|
||||
cat > alice-policy.json << 'EOF'
|
||||
{
|
||||
"AccessKeyMetadata": [
|
||||
{
|
||||
"UserName": "iam",
|
||||
"AccessKeyId": "B04R0WM64L0DAJ0N9LFZ",
|
||||
"Status": "Active"
|
||||
},
|
||||
{
|
||||
"UserName": "Bob",
|
||||
"AccessKeyId": "X8R439UM7OSQJX28I9QTP",
|
||||
"Status": "Active"
|
||||
}
|
||||
]
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": ["s3:Get*", "s3:List*"],
|
||||
"Resource": ["arn:aws:s3:::shared-bucket/*"]
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
|
||||
# 5. Attach policy to user
|
||||
aws --endpoint $AWS_ENDPOINT iam put-user-policy \
|
||||
--user-name alice \
|
||||
--policy-name SharedBucketReadOnly \
|
||||
--policy-document file://alice-policy.json
|
||||
|
||||
# 6. Verify
|
||||
echo 's3.configure' | weed shell
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [[Amazon IAM API]] - IAM API reference
|
||||
- [[S3 Credentials]] - Credential management options
|
||||
- [[AWS CLI with SeaweedFS]] - General AWS CLI setup
|
||||
- [[S3 Configuration]] - S3 server configuration
|
||||
|
||||
+173
-21
@@ -1,28 +1,180 @@
|
||||
To be compatible with Amazon IAM API, a separate "weed iam" command is provided.
|
||||
# Amazon IAM API
|
||||
|
||||
# How it works?
|
||||
`weed iam` will start a stateless gateway server to bridge the Amazon IAM API to SeaweedFS Filer.
|
||||
SeaweedFS provides AWS IAM API compatibility for managing users, access keys, and policies.
|
||||
|
||||
# Supported APIs only POST actions
|
||||
## Embedded IAM (Default)
|
||||
|
||||
```
|
||||
* CreateAccessKey
|
||||
* ListAccessKeys
|
||||
* DeleteAccessKey
|
||||
* CreateUser
|
||||
* ListUsers
|
||||
* GetUser
|
||||
* UpdateUser
|
||||
* DeleteUser
|
||||
* CreatePolicy
|
||||
* PutUserPolicy
|
||||
* GetUserPolicy
|
||||
* DeleteUserPolicy
|
||||
Starting with SeaweedFS 3.x, the IAM API is **embedded in the S3 server by default**. This means:
|
||||
|
||||
- IAM API is available on the same port as S3 (default: 8333)
|
||||
- No need to run a separate IAM server
|
||||
- Simplified deployment - single process handles both S3 and IAM
|
||||
|
||||
### Starting S3 with Embedded IAM
|
||||
|
||||
```bash
|
||||
# IAM is enabled by default
|
||||
weed s3 -filer=localhost:8888
|
||||
|
||||
# Or with weed server
|
||||
weed server -s3
|
||||
|
||||
# To explicitly disable embedded IAM
|
||||
weed s3 -iam=false -filer=localhost:8888
|
||||
```
|
||||
|
||||
# Authentication
|
||||
### Accessing the Embedded IAM API
|
||||
|
||||
By default, the access key and secret key to access weed iam is not authenticated. To enable credential based access, create an admin credentials to the example below
|
||||
The IAM API is available at the root path (`/`) of the S3 server using POST requests with an `Action` parameter:
|
||||
|
||||
```bash
|
||||
# IAM endpoint is the same as S3 endpoint
|
||||
export AWS_ENDPOINT=http://localhost:8333
|
||||
```
|
||||
echo 's3.configure -access_key some_access_key1 -secret_key some_secret_key1 -user iam -actions Admin -apply' | weed shell
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Standalone IAM (Deprecated)
|
||||
|
||||
> **Note**: The standalone `weed iam` command is deprecated. Please use the embedded IAM in the S3 server instead.
|
||||
|
||||
For backwards compatibility, you can still run a separate IAM server:
|
||||
|
||||
```bash
|
||||
weed iam -filer=localhost:8888 -port=8111
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Supported IAM Actions
|
||||
|
||||
| Action | Description | Self-Service |
|
||||
|--------|-------------|--------------|
|
||||
| `CreateUser` | Create a new IAM user | Admin only |
|
||||
| `DeleteUser` | Delete an IAM user | Admin only |
|
||||
| `GetUser` | Get user details | Yes (own user) |
|
||||
| `UpdateUser` | Update user properties | Admin only |
|
||||
| `ListUsers` | List all users | Admin only |
|
||||
| `CreateAccessKey` | Create access key for user | Yes (own keys) |
|
||||
| `DeleteAccessKey` | Delete access key | Yes (own keys) |
|
||||
| `ListAccessKeys` | List access keys for user | Yes (own keys) |
|
||||
| `CreatePolicy` | Validate a policy document | Admin only |
|
||||
| `PutUserPolicy` | Attach inline policy to user | Admin only |
|
||||
| `GetUserPolicy` | Get user's inline policy | Admin only |
|
||||
| `DeleteUserPolicy` | Remove user's inline policy | Admin only |
|
||||
|
||||
### Self-Service Operations
|
||||
|
||||
Users can manage their own access keys without admin privileges:
|
||||
- Create, delete, and list their own access keys
|
||||
- View their own user information
|
||||
|
||||
Operations on other users require `Admin` action permission.
|
||||
|
||||
---
|
||||
|
||||
## Authentication
|
||||
|
||||
### Setting Up Admin Credentials
|
||||
|
||||
Before using the IAM API, create an admin user with the `Admin` action:
|
||||
|
||||
```bash
|
||||
echo 's3.configure -access_key admin_key -secret_key admin_secret -user admin -actions Admin -apply' | weed shell
|
||||
```
|
||||
|
||||
### Using the IAM API
|
||||
|
||||
Set environment variables for AWS CLI:
|
||||
|
||||
```bash
|
||||
export AWS_ACCESS_KEY_ID=admin_key
|
||||
export AWS_SECRET_ACCESS_KEY=admin_secret
|
||||
export AWS_ENDPOINT=http://localhost:8333 # S3/IAM endpoint
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Examples
|
||||
|
||||
### Create a User and Access Key
|
||||
|
||||
```bash
|
||||
# Create user
|
||||
aws --endpoint $AWS_ENDPOINT iam create-user --user-name alice
|
||||
|
||||
# Create access key for user
|
||||
aws --endpoint $AWS_ENDPOINT iam create-access-key --user-name alice
|
||||
```
|
||||
|
||||
### Attach a Policy to User
|
||||
|
||||
```bash
|
||||
# Create policy document
|
||||
cat > policy.json << 'EOF'
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": ["s3:Get*", "s3:List*"],
|
||||
"Resource": ["arn:aws:s3:::my-bucket/*"]
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
|
||||
# Attach policy to user
|
||||
aws --endpoint $AWS_ENDPOINT iam put-user-policy \
|
||||
--user-name alice \
|
||||
--policy-name ReadOnlyPolicy \
|
||||
--policy-document file://policy.json
|
||||
```
|
||||
|
||||
### List Users and Access Keys
|
||||
|
||||
```bash
|
||||
# List all users
|
||||
aws --endpoint $AWS_ENDPOINT iam list-users
|
||||
|
||||
# List access keys for a user
|
||||
aws --endpoint $AWS_ENDPOINT iam list-access-keys --user-name alice
|
||||
```
|
||||
|
||||
### Self-Service: User Managing Their Own Keys
|
||||
|
||||
A non-admin user can manage their own access keys:
|
||||
|
||||
```bash
|
||||
# Set credentials for the user
|
||||
export AWS_ACCESS_KEY_ID=alice_access_key
|
||||
export AWS_SECRET_ACCESS_KEY=alice_secret_key
|
||||
|
||||
# User can create additional access keys for themselves
|
||||
aws --endpoint $AWS_ENDPOINT iam create-access-key
|
||||
# (no --user-name needed, defaults to authenticated user)
|
||||
|
||||
# List own access keys
|
||||
aws --endpoint $AWS_ENDPOINT iam list-access-keys
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Configuration Storage
|
||||
|
||||
IAM configurations are stored on the filer at `/etc/iam/identity.json`. Changes are automatically propagated to all S3 servers subscribed to filer metadata events.
|
||||
|
||||
You can view the current configuration:
|
||||
|
||||
```bash
|
||||
echo 's3.configure' | weed shell
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [[AWS IAM CLI]] - AWS CLI examples for IAM operations
|
||||
- [[S3 Credentials]] - Managing S3 access credentials
|
||||
- [[S3 Configuration]] - S3 server configuration options
|
||||
- [[Amazon S3 API]] - S3 API compatibility
|
||||
|
||||
+27
-1
@@ -194,11 +194,37 @@ See [[S3 Credentials]] for detailed information on each method.
|
||||
|
||||
---
|
||||
|
||||
## Embedded IAM API
|
||||
|
||||
Starting with SeaweedFS 3.x, the IAM API is embedded in the S3 server by default. This allows managing users, access keys, and policies using AWS IAM CLI commands on the same endpoint as S3.
|
||||
|
||||
```bash
|
||||
# Start S3 with embedded IAM (default)
|
||||
weed s3 -filer=localhost:8888
|
||||
|
||||
# IAM and S3 use the same endpoint
|
||||
aws --endpoint http://localhost:8333 iam create-user --user-name bob
|
||||
aws --endpoint http://localhost:8333 s3 ls
|
||||
```
|
||||
|
||||
### Disabling Embedded IAM
|
||||
|
||||
If you don't need IAM API functionality, you can disable it:
|
||||
|
||||
```bash
|
||||
weed s3 -iam=false -filer=localhost:8888
|
||||
```
|
||||
|
||||
See [[Amazon IAM API]] for detailed IAM usage.
|
||||
|
||||
---
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [[S3 Credentials]] - Detailed documentation for basic credentials
|
||||
- [[OIDC Integration]] - OIDC/STS integration guide
|
||||
- [[Amazon S3 API]] - S3 API compatibility reference
|
||||
- [[Amazon IAM API]] - IAM API support
|
||||
- [[Amazon IAM API]] - IAM API support (embedded in S3)
|
||||
- [[AWS IAM CLI]] - AWS CLI examples for IAM
|
||||
- [[Admin UI]] - Web-based credential management
|
||||
|
||||
|
||||
Reference in New Issue
Block a user