Is it possible to limit RestoreObject policy by data access tier?

0

Is it possible to create a policy such that it limits the s3:RestoreObject action only to a particular restore tier?

Example:

Can we have a policy that only allows "Bulk" restores, but it does not allow "Standard" nor "Expedited" restores.

I imagine if there is a way, it would have to do with the Condition element

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow only Bulk Restore",
            "Effect": "Allow",
            "Action": "s3:RestoreObject",
            "Resource": "arn:aws:s3:::mybucket/*",
            "Condition": {
                ?
            }
        }
    ]
}
Juan C
已提問 3 個月前檢視次數 93 次
1 個回答
0

Hi,

You may want to try the condition key s3:x-amz-storage-class which filters access by storage class. Take a look at this reference Actions, resources, and condition keys for Amazon S3 with the whole list.

When you grant access policy permissions for Amazon S3 operations, you can use the s3:x-amz-storage-class condition key to restrict which storage class to use when storing uploaded objects. For example, when you grant the s3:PutObject permission, you can restrict object uploads to a specific storage class. For an example policy, see Example 5: Restricting object uploads to objects with a specific storage class

I hope this helps!!!

AWS
SergioA
已回答 3 個月前
profile picture
專家
已審閱 2 個月前
  • Hi,

    I was checking the s3:x-amz-storage-class key, but it seems that this is for the target Storage Class of the operation. E.g. I could set the permission set to allow setting the files in one of these Storage Classes STANDARD | REDUCED_REDUNDANCY | STANDARD_IA | ONEZONE_IA | INTELLIGENT_TIERING | GLACIER | DEEP_ARCHIVE | OUTPOSTS | GLACIER_IR | SNOW | EXPRESS_ONEZONE.

    My question however is related to a file that's already in a cold storage tier (DEEP_ARCHIVE | GLACIER or the S3 Intelligent-Tiering Archive Access or Deep Archive Access storage tiers) and I want to Restore the object (which creates a copy of the object say in STANDARD for X days). The speed of the restore is managed by the "Retrieval tier" selected (Bulk | Standard | Expedited) which also affects the cost of the operation.

    I would like to have a permission set that only allows to use the RestoreObject action for say the Bulk Retrieval tier.

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南