Showing posts with label s3. Show all posts
Showing posts with label s3. Show all posts

Thursday, August 7, 2014

Failed Access Denied: S3 properties on us-east-1 region

When I created s3 buckets at each regions including us-east-1, us-west1, us-west-2, and ap-northeast-1 and applied the IAM policies below to a IAM group. I got some of the properties of other than us-east-1 region somehow.
I created an IAM group and attached two IAM policies with the group.
  • IAM policy to define the buckets to operate and access source IP address.
{ "Statement": [ { "Condition": { "IpAddress": { "aws:SourceIp": [ "xxx.xxx.xxx.xxx/32", "xxx.xxx.xxx.xxx/32" ] } }, "Resource": [ "arn:aws:s3:::bucket_name.ap-northeast-1", "arn:aws:s3:::bucket_name.ap-northeast-1/*", "arn:aws:s3:::bucket_name.us-west-1", "arn:aws:s3:::bucket_name.us-west-1/*", "arn:aws:s3:::bucket_name.us-west-1", "arn:aws:s3:::bucket_name.us-west-1/*", "arn:aws:s3:::bucket_name.us-west-2", "arn:aws:s3:::bucket_name.us-west-2/*" ], "Action": "s3:*", "Effect": "Allow" } ], "Version": "2012-10-17" }
  • IAM policy to list all the buckets for a s3 tool like S3 Browser
{
  "Statement": [
    {
      "Resource": "*",
      "Action": "s3:List*",
      "Effect": "Allow"
    }
  ],
  "Version": "2012-10-17"
}
I got the properties of us-west-1, us-west-2, ap-northeast-1, but couldn't get those of us-east-1, though the same IAM policies are applied.


I successfully got the properties of us-east-1 after adding the action as follows.



{
  "Statement": [
    {
      "Resource": "*",
      "Action": [
        "s3:List*",
        "s3:Get*"
      ],
      "Effect": "Allow"
    }
  ],
  "Version": "2012-10-17"
}

I am wondering if us-east-1 (US standard) region is different from other regions in how to apply IAM policy because it is the 1st region of AWS???

Wednesday, June 11, 2014

AWS CLI memorandum - Delete S3 Buckets and all of the objects simultaneously

When we put some objects into S3 bucket to verify or validate a CloudFormation stack by uploading a template to S3 bucket, the buckets store thousands of objects that I don't have to keep anymore and we sometimes have to pay too much cost for that after receiving the billing.

Why don't we delete all of the objects and buckets simultaneously or you should consider of using Object Lifecycle Management in advance to automatically delete the objects that has been expired.

* List the buckets you want to remove and input them into a file
* Recursively delete all of the objects, the buckets and confirm that they are deleted
* Use --quiet option if you want to quietly remove

That's it!

iJAWS@Doorkeeper