Added permissions for s3 copy to have permission to write to cache bucket #531
Conversation
|
Should we limit it to a "sharing" keyspace in the bucket.. |
|
Sure, or a 'restore' keyspace? |
|
Yes -name to be decided .. "restore" sounds good. @reisingerf ? |
|
So the Get and List should be *, and the Put and Delete restricted I think. |
|
Also, "s3:GetObjectVersion" seems to be missing from the lists.. if GetObjectVersionTagging is there - so should the ability to get the actual versioned objects too |
|
Yes, a restriction to a "restore" prefix would be good. Also happy with 'restore' or perhaps better 'restored' as it sounds more of a fact and less of a ToDo. As for the permissions, they are probably a bit too generous. I don't think we need to deal with version (of tags nor objects). Versioning at the moment is an emergency backup in case something went wrong and then it generally requires an admin to sort things out. |
|
Updated, split read / write statements and added restore prefix to write roles |
Resolves #530