Creating Permissions

Permissions control access to buckets and define which actions the service accounts can perform on a bucket.

Bucket permission and Policy permission are two options available for granting permission to your buckets.

• Bucket permission: Bucket permission is used to set Read only, Write only, or All operations permission for selected buckets. Using Bucket permissions, you can grant access permissions to your bucket and the objects in the bucket. Only the admin and storage admin can associate permissions for the buckets. The permissions attached to the bucket apply to all of the objects in the bucket. For more information, see Managing bucket access permissions.
• Policy permission: Policy permissions are used to manage bucket-level permission by uploading a JSON file. You can also import a file compatible with the AWS IAM policy file. Using the Policy permission, you can allow or deny requests at a granular level based on the elements in the policy, resources, and aspects or conditions of the request. For more information, see Creating policy permissions.

Creating new permissions

You can create bucket permissions without any buckets in the account only if you apply permission to all buckets in the account or all buckets with a prefix.

Apply permission types using the type parameter.

• One or more existing buckets: Choose one or more from the bucket list.
• All buckets in this account with a prefix: The bucket names must use the same few initial characters. For example, if four unique buckets for customer01 are created, such as customer01rawdata, customer01zipdata, customer01media and customer01, enter a prefix of the bucket names to assign and apply the permission. In this case, use the same beginning characters for each bucket for our prefix, customer01.
• All buckets in the account: Apply permission to all current and future buckets in the account.
• Policy: Upload or import a JSON file compatible with the AWS IAM policy file. Specify the details of the permission at a granular level.

Apply actions using the action parameter.

• All Operations: This option allows to perform all operations on all buckets meeting the conditions applied using the type parameter.
• Read only: This option allows you to perform a read only operation on all buckets meeting the condition applied using the type parameter.
• Write only: This option allows you to write objects without reading them back on all buckets meetings the conditions applied using the type parameter.

Using the Policy permission file

In the example below, the policy permission has three statements:

• Statement 1: Allows object listing with a prefix in the bucket. It is done using a Condition element.
• Statement 2: Allows read and write operations for objects with the prefix in the bucket.
• Statement 3: Denies delete object operation.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "statement1",
      "Action": [
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::mybucket"
      ],
      "Condition": {
        "StringLike": {
          "s3:prefix": [
            "David/*"
          ]
        }
      }
    },
    {
      "Sid": "statement2",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::mybucket/David/*"
      ]
    },
    {
      "Sid": "statement3",
      "Action": [
        "s3:DeleteObject"
      ],
      "Effect": "Deny",
      "Resource": [
        "arn:aws:s3:::mybucket/David/*",
        "arn:aws:s3:::mycorporatebucket/share/marketing/*"
      ]
    }
  ]
}

The following example illustrates creating a policy permission file using Account API.

{
"name":"permission_name",
"description":"Test data",
"type":"policy",
"policy":"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"statement15feb1\",\"Effect\":\"Allow\",\"Action\":[\"s3:*\"],\"Resource\":[\"arn:aws:s3:::*/*\"]}]}"
}

Request

The POST request creates controlled access to the buckets and defines actions the service account can perform on the specified buckets in the account.

POST/permissions

Body parameter

{
  "name": "string", 
  "description": "string", 
  "type": "all-buckets", 
  "actions": "all-operations", 
  "prefix": "string", 
  "buckets": [ "string" ], 
  "policy": {}
}

Parameters

Code samples

Go

    package main

    import (
        "bytes"
        "net/http"
    )

    func main() {
        headers := map[string][]string{
            "Content-Type": []string{
                "application/json",
            },
            "Accept": []string{
                "application/json",
            },
            "Authorization": []string{
                "Bearer {access-token}",
            },
        }

        jsonReq := `{"key":"value"}` // replace with your JSON request
        data := bytes.NewBuffer([]byte(jsonReq))
        req, err := http.NewRequest("PUT", "https://api.lyvecloud.seagate.com/v2/permissions/", data)
        if err != nil {
            // handle error
        }
        req.Header = headers

        client := &http.Client{}
        resp, err := client.Do(req)
        if err != nil {
            // handle error
        }
        // handle response _ = resp }

Java

    import java.net.HttpURLConnection;
    import java.net.URL;
    import java.io.BufferedReader;
    import java.io.InputStreamReader;
    import java.io.OutputStream;

    public class Main {
        public static void main(String[] args) {
            try {
                URL obj = new URL("https://api.lyvecloud.seagate.com/v2/permissions/");
                HttpURLConnection con = (HttpURLConnection) obj.openConnection();
                con.setRequestMethod("PUT");
                
                // For a PUT request, we need to send data
                con.setDoOutput(true);
                String jsonInputString = "{\"key\": \"value\"}"; // replace with your actual JSON data
                try(OutputStream os = con.getOutputStream()) {
                    byte[] input = jsonInputString.getBytes("utf-8");
                    os.write(input, 0, input.length);           
                }
                
                int responseCode = con.getResponseCode();
                BufferedReader in = new BufferedReader(new InputStreamReader(con.getInputStream()));
                String inputLine;
                StringBuffer response = new StringBuffer();
                while ((inputLine = in.readLine()) != null) {
                    response.append(inputLine);
                }
                in.close();
                System.out.println(response.toString());
            } catch (Exception e) { e.printStackTrace(); } } }

JavaScript

    const inputBody = `{
        "name": "string",
        "description": "string",
        "type": "all-buckets",
        "actions": "all-operations",
        "prefix": "string",
        "buckets": ["string"],
        "policy": {}
    }`;

    const headers = {
        'Content-Type': 'application/json',
        'Accept': 'application/json',
        'Authorization': 'Bearer {access-token}'
    };

    fetch('https://api.lyvecloud.seagate.com/v2/permissions/', {
        method: 'PUT',
        body: inputBody,
        headers: headers
    })
    .then(function(res) {
        return res.json();
    }).then(function(body) { console.log(body); });

Python

    import requests
    headers = {
        'Content-Type': 'application/json',
        'Accept': 'application/json',
        'Authorization': 'Bearer {access-token}'
    }
    r = requests.put('https://api.lyvecloud.seagate.com/v2/permissions/', headers=headers) print(r.json())

Ruby

    require 'rest-client'
    require 'json'

    headers = {
        'Content-Type' => 'application/json',
        'Accept' => 'application/json',
        'Authorization' => 'Bearer {access-token}'
    }

    data = {
        "name" => "string",
        "description" => "string",
        "type" => "all-buckets",
        "actions" => "all-operations",
        "prefix" => "string",
        "buckets" => ["string"],
        "policy" => {}
    }

    result = RestClient.put 'https://api.lyvecloud.seagate.com/v2/permissions/', data.to_json, headers: headers

    p JSON.parse(result)
  

Responses

{
  "id": "string"
}

{
  "code": "string",
  "message": "string"
}

{
  "code": "string",
  "message": "string"
}

{
  "code": "string",
  "message": "string"
}

{
  "code": "string",
  "message": "string"
}

{
  "code": "string",
  "message": "string"
}