AWS AmazonS3 documentation change
Summary
Added documentation for access point operations and associated IAM permissions including Create/Delete/Manage AccessPoint policies and scopes
Security assessment
Expands IAM security documentation with new access point management capabilities, but no evidence of addressing existing vulnerabilities
Diff
diff --git a/AmazonS3/latest/userguide/s3-express-security-iam.md b/AmazonS3/latest/userguide/s3-express-security-iam.md index 34f642a8f..6f949aeea 100644 --- a//AmazonS3/latest/userguide/s3-express-security-iam.md +++ b//AmazonS3/latest/userguide/s3-express-security-iam.md @@ -78,0 +79,13 @@ You can specify the following actions in the `Action` element of an IAM policy s +###### Note + +If you want to use access points for directory buckets to control access to bucket or object operations, note the following: + + * For using access points to control access to bucket operations, see [Bucket operations in policies for access points for directory buckets](./security_iam_service-with-iam.html#bucket-operations-ap-directory-buckets). + + * For using access points to control access to object operations, see [Object operations in policies for access points for directory buckets](./security_iam_service-with-iam.html#object-operations-ap-directory-buckets). + + * For more information about how to configure access point policies, see [Configuring IAM policies for using access points for directory buckets](./access-points-directory-buckets-policies.html). + + + + @@ -92,0 +106,10 @@ Action | API | Description | Access level | Condition keys +`s3express:CreateAccessPoint` | `CreateAccessPoint` | Grants permission to create an access point associated with an directory bucket. | Write | s3express:DataAccessPointAccount s3express:DataAccessPointArn s3express:AccessPointNetworkOrigin s3express:authType s3express:LocationName s3express:ResourceAccount s3express:signatureversion s3express:TlsVersion s3express:x-amz-content-sha256 +`s3express:ListAccessPointsForDirectoryBuckets` | `ListAccessPointsForDirectoryBuckets` | Grants permission to list access points. | List | s3express:authType s3express:ResourceAccount s3express:signatureversion s3express:TlsVersion s3express:x-amz-content-sha256 +`s3express:GetAccessPoint` | `GetAccessPoint` | Grants permission to return configuration information about the specified access point. | Read | s3express:DataAccessPointAccount s3express:DataAccessPointAccount s3express:DataAccessPointArn s3express:AccessPointNetworkOrigin s3express:authType s3express:ResourceAccount s3express:signatureversion s3express:TlsVersion s3express:x-amz-content-sha256 +`s3express:DeleteAccessPoint` | `DeleteAccessPoint` | Grants permission to delete the access point named in the URI. | Write | s3express:DataAccessPointAccount s3express:DataAccessPointAccount s3express:DataAccessPointArn s3express:AccessPointNetworkOrigin s3express:authType s3express:ResourceAccount s3express:signatureversion s3express:TlsVersion s3express:x-amz-content-sha256 +`s3express:DeleteAccessPointPolicy` | `DeleteAccessPointPolicy` | Grants access to delete the policy on a specified access point. | Permissions management | s3express:DataAccessPointAccount s3express:DataAccessPointArn s3express:AccessPointNetworkOrigin s3express:authType s3express:ResourceAccount s3express:signatureversion s3express:TlsVersion s3express:x-amz-content-sha256 +`s3express:GetAccessPointPolicy` | `GetAccessPointPolicy` | Grants permission to return the access point policy associated with the specified access point. | Read | s3express:DataAccessPointAccount s3express:DataAccessPointAccount s3express:DataAccessPointArn s3express:AccessPointNetworkOrigin s3express:authType s3express:ResourceAccount s3express:signatureversion s3express:TlsVersion s3express:x-amz-content-sha256 +`s3express:PutAccessPointPolicy` | `PutAccessPointPolicy` | Grants permission to associate an access point policy with a specified access point. | Permissions management | s3express:DataAccessPointAccount s3express:DataAccessPointArn s3express:AccessPointNetworkOrigin s3express:authType s3express:ResourceAccount s3express:signatureversion s3express:TlsVersion s3express:x-amz-content-sha256 +`s3express:DeleteAccessPointScope` | `DeleteAccessPointScope` | Grants permission to delete the scope configuration on a specified access point. | Permissions management | s3express:DataAccessPointAccount s3express:DataAccessPointArn s3express:AccessPointNetworkOrigin s3express:authType s3express:ResourceAccount s3express:signatureversion s3express:TlsVersion s3express:x-amz-content-sha256 +`s3express:GetAccessPointScope` | `GetAccessPointScope` | Grants permission to return the scope configuration associated with the specified access point. | Read | s3express:DataAccessPointAccount s3express:DataAccessPointArn s3express:AccessPointNetworkOrigin s3express:authType s3express:ResourceAccount s3express:signatureversion s3express:TlsVersion s3express:x-amz-content-sha256 +`s3express:PutAccessPointScope` | `PutAccessPointScope` | Grants permission to associate an access point with a specified access point scope configuration. | Permissions management | s3express:DataAccessPointAccount s3express:DataAccessPointArn s3express:AccessPointNetworkOrigin s3express:authType s3express:ResourceAccount s3express:signatureversion s3express:TlsVersion s3express:x-amz-content-sha256