From 90969ca5ee35b7024febe747cebc49b850010642 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 25 Mar 2026 22:33:09 -0700 Subject: [PATCH] doc: update s3.bucket.access to IAM-based approach with -user flag --- S3-Bucket-Policies.md | 25 ++++++++++--------------- weed-shell.md | 2 +- 2 files changed, 11 insertions(+), 16 deletions(-) diff --git a/S3-Bucket-Policies.md b/S3-Bucket-Policies.md index 96b511b..7ad2266 100644 --- a/S3-Bucket-Policies.md +++ b/S3-Bucket-Policies.md @@ -8,30 +8,25 @@ Bucket policies allow you to grant or deny permissions for S3 operations on a bu ## Quick Setup with Weed Shell -The `s3.bucket.access` shell command provides a simple way to configure anonymous access without external tools. +The `s3.bucket.access` shell command provides a simple way to set per-bucket access for any user. The user is auto-created if it does not exist. ```bash -# View current anonymous access policy -> s3.bucket.access -name my-bucket - # Grant anonymous read and list access (public download) -> s3.bucket.access -name my-bucket -access read,list +> s3.bucket.access -name my-bucket -user anonymous -access Read,List # Grant full anonymous access -> s3.bucket.access -name my-bucket -access read,write,list +> s3.bucket.access -name my-bucket -user anonymous -access Read,Write,List -# Remove all anonymous access (make private) -> s3.bucket.access -name my-bucket -access none +# View current access for a user on a bucket +> s3.bucket.access -name my-bucket -user anonymous + +# Remove all access +> s3.bucket.access -name my-bucket -user anonymous -access none ``` -Supported permissions: `read` (GetObject), `write` (PutObject, DeleteObject, multipart), `list` (ListBucket). +Supported actions: `Read`, `Write`, `List`, `Tagging`, `Admin` (same as `s3.configure -actions`). -The command writes a standard bucket policy with `Principal: "*"`. Other (non-anonymous) policy statements are preserved when changing access. - -**Note:** Read and list access work with the bucket policy alone. Write access additionally requires an `anonymous` identity in IAM — create one via the admin UI or: -```bash -> s3.configure -user=anonymous -apply -``` +Actions are scoped to the specified bucket and stored on the IAM identity (as `Action:bucket`). ## AWS CLI Setup diff --git a/weed-shell.md b/weed-shell.md index 641971a..d1462be 100644 --- a/weed-shell.md +++ b/weed-shell.md @@ -52,7 +52,7 @@ Type: "help " for help on . Most commands support " - remote.mount.buckets # mount all buckets in remote storage and pull its metadata remote.uncache # keep the metadata but remote cache the file content for mounted directories or files remote.unmount # unmount remote storage - s3.bucket.access # view or change the anonymous access policy of an S3 bucket + s3.bucket.access # view or set per-bucket access for a user s3.bucket.create # create a bucket with a given name s3.bucket.delete # delete a bucket by a given name s3.bucket.list # list all buckets