AWS res documentation change
Summary
Restructured S3 bucket documentation by removing inline content and replacing with links to dedicated sub-pages for each management task
Security assessment
The changes reorganize existing content into separate pages but don't introduce new security information or address specific vulnerabilities. Security-related sections like data isolation and cross-account access were moved to dedicated pages but not modified in this diff.
Diff
diff --git a/res/archive/release-minus-4/ug/S3-buckets.md b/res/archive/release-minus-4/ug/S3-buckets.md index 2b61374c3..0642ebacd 100644 --- a//res/archive/release-minus-4/ug/S3-buckets.md +++ b//res/archive/release-minus-4/ug/S3-buckets.md @@ -5,2 +4,0 @@ -Mount an Amazon S3 bucketAdd an Amazon S3 bucketEdit an Amazon S3 bucketRemove an Amazon S3 bucketData IsolationCross account bucket accessPreventing data exfiltration in a private VPCTroubleshooting Enabling CloudTrail - @@ -9,26 +7 @@ Mount an Amazon S3 bucketAdd an Amazon S3 bucketEdit an Amazon S3 bucketRemove a -###### Topics - - * Mount an Amazon S3 bucket - - * Add an Amazon S3 bucket - - * Edit an Amazon S3 bucket - - * Remove an Amazon S3 bucket - - * Data Isolation - - * Cross account bucket access - - * Preventing data exfiltration in a private VPC - - * Troubleshooting - - * Enabling CloudTrail - - - - -## Mount an Amazon S3 bucket - -Research and Engineering Studio (RES) supports mounting Amazon S3 buckets to Linux Virtual Desktop Infrastructure (VDI) instances. RES Administrators can onboard S3 buckets to RES, attach them to projects, edit their configuration, and remove buckets in the S3 buckets tab under **Environment Management**. +Research and Engineering Studio (RES) supports mounting [Amazon S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/index.html) to Linux Virtual Desktop Infrastructure (VDI) instances. RES Administrators can onboard S3 buckets to RES, attach them to projects, edit their configuration, and remove buckets in the S3 buckets tab under **Environment Management**. @@ -53,207 +26 @@ The S3 buckets dashboard provides a list of onboarded S3 buckets available to yo -## Add an Amazon S3 bucket - -###### To add an S3 bucket to your RES environment: - - 1. Choose **Add bucket**. - - 2. Enter the bucket details such as bucket name, ARN, and mount point. - -###### Important - - * The bucket ARN, mount point, and mode provided cannot be changed after creation. - - * The bucket ARN can contain a prefix which will isolate the onboarded S3 bucket to that prefix. - - 3. Select a mode in which to onboard your bucket. - -###### Important - - * See Data Isolation for more information related to data isolation with specific modes. - - 4. Under **Advanced Options** , you may provide an IAM role ARN to mount the buckets for cross account access. Follow the steps in Cross account bucket access to create the required IAM role for cross account access. - - 5. (Optional) Associate the bucket with projects, which can be changed later. However, an S3 bucket cannot be mounted to a project's existing VDI sessions. Only sessions launched after the project has been associated with the bucket will mount the bucket. - - 6. Choose **Submit**. - - - - - - -## Edit an Amazon S3 bucket - - 1. Select an S3 bucket in the S3 buckets list. - - 2. From the **Actions** menu, choose **Edit**. - - 3. Enter your updates. - -###### Important - - * Associating a project with an S3 bucket will **not** mount the bucket to that project's existing virtual desktop infrastructure (VDI) instances. The bucket will only be mounted to VDI sessions launched in a project after the bucket has been associated with that project. - - * Disassociating a project from an S3 bucket will not impact the data in the S3 bucket, but will result in desktop users losing access to that data. - - 4. Choose **Save bucket setup**. - - - - - - -## Remove an Amazon S3 bucket - - 1. Select an S3 bucket in the S3 buckets list. - - 2. From the **Actions** menu, choose **Remove**. - -###### Important - - * You must first remove all project associations from the bucket. - - * The remove operation does not impact the data in the S3 bucket. It only removes the S3 bucket’s association with RES. - - * Removing a bucket will cause existing VDI sessions to lose access to the contents of that bucket at the expiration of that session’s credentials (~1 hour). - - - - -## Data Isolation - -When you add an S3 bucket to RES, you have options to isolate the data within the bucket to specific projects and users. On the **Add Bucket** page, you can choose a mode of Read Only (R) or Read and Write (R/W). - -**Read Only** - -If `Read Only (R)` is selected, data isolation is enforced based on the prefix of the bucket ARN (Amazon Resource Name). For example, if an admin adds a bucket to RES using the ARN `arn:aws:s3:::`bucket-name``/example-data`/` and associates this bucket with Project A and Project B, then users launching VDIs from within Project A and Project B can only read the data located in `bucket-name` under the path `/example-data`. They will not have access to data outside of that path. If there is no prefix appended to the bucket ARN, the entire bucket will be made available to any project associated with it. - -**Read and Write** - -If `Read and Write (R/W)` is selected, data isolation is still enforced based on the prefix of the bucket ARN, as described above. This mode has additional options to allow admins to provide variable-based prefixing for the S3 bucket. When `Read and Write (R/W)` is selected, a Custom Prefix section becomes available that offers a dropdown menu with the following options: - - * No custom prefix - - * /%p - - * /%p/%u - - - - - - -**No custom data isolation** - - -When `No custom prefix` is selected for **Custom Prefix** , the bucket is added without any custom data isolation. This allows any projects associated with the bucket to have read and write access. For example, if an admin adds a bucket to RES using the ARN `arn:aws:s3:::`bucket-name`` with `No custom prefix` selected and associates this bucket with Project A and Project B, users launching VDIs from within Project A and Project B will have unrestricted read and write access to the bucket. - -**Data isolation on a per-project level** - - -When `/%p` is selected for **Custom Prefix** , data in the bucket is isolated to each specific project associated with it. The `%p` variable represents the project code. For example, if an admin adds a bucket to RES using the ARN `arn:aws:s3:::`bucket-name`` with `/%p` selected and a **Mount Point** of `/bucket`, and associates this bucket with Project A and Project B, then User A in Project A can write a file to `/bucket`. User B in Project A can also see the file that User A wrote in `/bucket`. However, if User B launches a VDI in Project B and looks in `/bucket`, they will not see the file that User A wrote, as the data is isolated by project. The file User A wrote is found in the S3 bucket under the prefix `/ProjectA` while User B can only access `/ProjectB` when using their VDIs from Project B. - -**Data isolation on a per-project, per-user level** - - -When `/%p/%u` is selected for **Custom Prefix** , data in the bucket is isolated to each specific project and user associated with that project. The `%p` variable represents the project code, and `%u` represents the username. For example, an admin adds a bucket to RES using the ARN `arn:aws:s3:::`bucket-name`` with `/%p/%u` selected and a Mount Point of `/bucket`. This bucket is associated with Project A and Project B. User A in Project A can write a file to `/bucket`. Unlike the prior scenario with only `%p` isolation, User B in this case will not see the file User A wrote in Project A in `/bucket`, as the data is isolated by both project and user. The file User A wrote is found in the S3 bucket under the prefix `/ProjectA/UserA` while User B can only access `/ProjectA/UserB` when using their VDIs in Project A. - -## Cross account bucket access - -RES has the ability to mount buckets from other AWS accounts, provided these buckets have the right permissions. In the following scenario, a RES environment in Account A wants to mount an S3 bucket in Account B. - -###### Step 1: Create an IAM Role in the account that RES is deployed in _(this will be referred to as Account A)_ : - - 1. Sign in to the AWS Management Console for the RES account that needs access to the S3 bucket (Account A). - - 2. Open the IAM Console: - - 1. Navigate to the IAM dashboard. - - 2. In the navigation pane, select **Policies**. - - 3. Create a Policy: - - 1. Select **Create policy**. - - 2. Choose the **JSON** tab. - - 3. Paste the following JSON policy (replace `amzn-s3-demo-bucket` with the name of the S3 bucket located in Account B): - -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "s3:GetObject", - "s3:PutObject", - "s3:ListBucket", - "s3:DeleteObject", - "s3:AbortMultipartUpload" - ], - "Resource": [ - "arn:aws:s3:::amzn-s3-demo-bucket", - "arn:aws:s3:::amzn-s3-demo-bucket/*" - ] - } - ] - } - - - 4. Select **Next**. - - 4. Review and create the policy: - - 1. Provide a name for the policy (for example, "S3AccessPolicy"). - - 2. Add an optional description to explain the purpose of the policy. -