doc: update s3.bucket.access to IAM-based approach with -user flag

S3-Bucket-Policies.md

@@ -8,30 +8,25 @@ Bucket policies allow you to grant or deny permissions for S3 operations on a bu
 
 ## Quick Setup with Weed Shell
 
-The `s3.bucket.access` shell command provides a simple way to configure anonymous access without external tools.
+The `s3.bucket.access` shell command provides a simple way to set per-bucket access for any user. The user is auto-created if it does not exist.
 
 ```bash
-# View current anonymous access policy
-> s3.bucket.access -name my-bucket
-
 # Grant anonymous read and list access (public download)
-> s3.bucket.access -name my-bucket -access read,list
+> s3.bucket.access -name my-bucket -user anonymous -access Read,List
 
 # Grant full anonymous access
-> s3.bucket.access -name my-bucket -access read,write,list
+> s3.bucket.access -name my-bucket -user anonymous -access Read,Write,List
 
-# Remove all anonymous access (make private)
-> s3.bucket.access -name my-bucket -access none
+# View current access for a user on a bucket
+> s3.bucket.access -name my-bucket -user anonymous
+
+# Remove all access
+> s3.bucket.access -name my-bucket -user anonymous -access none
 ```
 
-Supported permissions: `read` (GetObject), `write` (PutObject, DeleteObject, multipart), `list` (ListBucket).
+Supported actions: `Read`, `Write`, `List`, `Tagging`, `Admin` (same as `s3.configure -actions`).
 
-The command writes a standard bucket policy with `Principal: "*"`. Other (non-anonymous) policy statements are preserved when changing access.
-
-**Note:** Read and list access work with the bucket policy alone. Write access additionally requires an `anonymous` identity in IAM — create one via the admin UI or:
-```bash
-> s3.configure -user=anonymous -apply
-```
+Actions are scoped to the specified bucket and stored on the IAM identity (as `Action:bucket`).
 
 ## AWS CLI Setup
 

weed-shell.md

@@ -52,7 +52,7 @@ Type:	"help <command>" for help on <command>. Most commands support "<command> -
   remote.mount.buckets          	# mount all buckets in remote storage and pull its metadata 
   remote.uncache                	# keep the metadata but remote cache the file content for mounted directories or files 
   remote.unmount                	# unmount remote storage 
-  s3.bucket.access              	# view or change the anonymous access policy of an S3 bucket
+  s3.bucket.access              	# view or set per-bucket access for a user
   s3.bucket.create              	# create a bucket with a given name
   s3.bucket.delete              	# delete a bucket by a given name
   s3.bucket.list                	# list all buckets