Skip to main content

Privacera Documentation

AWS S3 Commands - Ranger Permission Mapping

In AWS IAM policies for S3 there are numerous permissions, see the table below to see which permissions are required for each operation.

Operation\Access Type

AccessType

Sample Command

Read

Write

Delete

Metadata Read

Metadata Write

Admin

list-buckets

aws s3api list-buckets

list-objects

query:list-type

aws s3api list-objects --bucket infraqa-test-bubble --region us-east-1 aws s3api list-objects-v2 --bucket infraqa-test-bubble --region us-east-1

list-multipart-uploads

query

aws s3api list-multipart-uploads --bucket infraqa-test-bubble --region us-east-1

list-object-versions

query:versions

aws s3api list-object-versions --bucket infraqa-test-bubble --region us-east-1

list-parts

query

aws s3api list-parts --bucket infraqa-test-bubble --key 'file data/output/format=csv/sample/variety/sample_with_dot_data.csv' --upload-id <upload-id>

get-bucket-accelerate-configuration

query:accelerate

aws s3api get-bucket-accelerate-configuration --bucket infraqa-test

get-bucket-acl

query:acl

aws s3api get-bucket-acl --bucket infraqa-test

get-object-acl

query

aws s3api get-object-acl --bucket infraqa-test --key 'file data/data/format=csv/sample/variety/sample_with_dot_data.csv'

get-bucket-analytics-configuration

query:analytics

aws s3api get-bucket-analytics-configuration --bucket infraqa-test --id 1

list-bucket-analytics-configurations

query:analytics

aws s3api list-bucket-analytics-configurations --bucket infraqa-test

get-bucket-cors

query:cors

aws s3api get-bucket-cors --bucket infraqa-test

get-bucket-encryption

query:encryption

aws s3api get-bucket-encryption --bucket infraqa-test

get-bucket-inventory-configuration

query:inventory

aws s3api get-bucket-inventory-configuration --bucket infraqa-test --id 1

list-bucket-inventory-configurations

query:inventory

aws s3api list-bucket-inventory-configurations --bucket infraqa-test

get-bucket-lifecycle-configuration

query:lifecycle

aws s3api get-bucket-lifecycle-configuration --bucket infraqa-test

get-bucket-location

query:location

aws s3api get-bucket-location --bucket infraqa-test

get-bucket-metrics-configuration

query:metrics

aws s3api get-bucket-metrics-configuration --bucket infraqa-test --id 1

list-bucket-metrics-configurations

query:metrics

aws s3api list-bucket-metrics-configurations --bucket infraqa-test

get-bucket-notification-configuration

query:notification

aws s3api get-bucket-notification-configuration --bucket infraqa-test

get-bucket-policy

query:policy

aws s3api get-bucket-policy --bucket infraqa-test

get-bucket-replication

query:replication

aws s3api get-bucket-replication --bucket infraqa-test

get-bucket-request-payment

query:requestPayment

aws s3api get-bucket-request-payment --bucket infraqa-test

get-bucket-tagging

query:tagging

aws s3api get-bucket-tagging --bucket infraqa-test

get-object-tagging

query

aws s3api get-object-tagging --bucket infraqa-test --key 'file data/data/format=csv/sample/variety/sample_with_dot_data.csv'

get-bucket-versioning

query:versioning

aws s3api get-bucket-versioning --bucket infraqa-test

get-bucket-website

query:website

aws s3api get-bucket-website --bucket infraqa-test

list-object-versions

query:versions

aws s3api list-object-versions --bucket infraqa-test

delete-bucket

delete

aws s3api delete-bucket --bucket infraqa-test-bubble --region us-east-1

delete-object

delete

aws s3api delete-object --bucket infraqa-test-bubble --key 'file data/output/format=csv/sample/variety/sample_with_dot_data.csv'

delete-objects

delete

aws s3api delete-objects --bucket infraqa-test-bubble --delete file://delete.json

delete-bucket-analytics-configuration

delete:analytics

aws s3api delete-bucket-analytics-configuration --bucket infraqa-test-bubble --id 1

delete-bucket-cors

delete:cors

aws s3api delete-bucket-cors --bucket infraqa-test-bubble

delete-bucket-encryption

delete:encryption

aws s3api delete-bucket-encryption --bucket infraqa-test-bubble

delete-bucket-inventory-configuration

delete:inventory

aws s3api delete-bucket-inventory-configuration --bucket infraqa-test-bubble --id 1

delete-bucket-lifecycle

delete:lifecycle

aws s3api delete-bucket-lifecycle --bucket infraqa-test-bubble

delete-bucket-metrics-configuration

delete:metrics

aws s3api delete-bucket-metrics-configuration --bucket infraqa-test-bubble --id 123

delete-bucket-policy

delete:policy

aws s3api delete-bucket-policy --bucket infraqa-test-bubble

delete-bucket-replication

delete:replication

aws s3api delete-bucket-replication --bucket infraqa-test-bubble

delete-bucket-tagging

delete:tagging

aws s3api delete-bucket-tagging --bucket infraqa-test-bubble

delete-object-tagging

delete:tagging

aws s3api delete-object-tagging --bucket infraqa-test-bubble --key 'file data/data/format=csv/sample/variety/sample_with_dot_data.csv'

delete-bucket-website

delete:website

aws s3api delete-bucket-website --bucket infraqa-test-bubble

put-object

create

aws s3api put-object --bucket infraqa-test --key 'file data/output/format=csv/sample/variety/sample_with_dot_data.csv' --body privacera_aws_ote.csv

put-bucket-accelerate-configuration

create:accelerate

aws s3api put-bucket-accelerate-configuration --bucket infraqa-test --accelerate-configuration Status=Enabled

put-bucket-acl

create:acl

aws s3api put-bucket-acl --bucket infraqa-test-bubble --grant-full-control emailaddress=user1@example.com,emailaddress=user2@example.com --grant-read uri=http://acs.amazonaws.com/groups/global/AllUsers

put-object-acl

create:acl

aws s3api put-object-acl --bucket infraqa-test-bubble --key 'file data/data/format=csv/sample/variety/sample_with_dot_data.csv' --grant-full-control emailaddress=user1@example.com,emailaddress=user2@example.com --grant-read uri=http://acs.amazonaws.com/groups/global/AllUsers

put-bucket-analytics-configuration

create:analytics

aws s3api put-bucket-analytics-configuration --bucket infraqa-test-bubble --id 1 --analytics-configuration '{"Id": "1","StorageClassAnalysis": {}}'

put-bucket-cors

create:cors

aws s3api put-bucket-cors --bucket infraqa-test-bubble --cors-configuration file://cors.json

put-bucket-encryption

create:encryption

aws s3api put-bucket-encryption --bucket infraqa-test-bubble --server-side-encryption-configuration '{"Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "AES256"}}]}'

put-bucket-inventory-configuration

create:inventory

aws s3api put-bucket-inventory-configuration --bucket infraqa-test-bubble --id 1 --inventory-configuration '{"Destination": { "S3BucketDestination": { "AccountId": "123456789012", "Bucket": "arn:aws:s3:::my-bucket", "Format": "ORC" }}, "IsEnabled": true, "Id": "1", "IncludedObjectVersions": "Current", "Schedule": { "Frequency": "Weekly" }}'

put-bucket-lifecycle-configuration

create:lifecycle

aws s3api put-bucket-lifecycle-configuration --bucket infraqa-test-bubble --lifecycle-configuration file://lifecycle.json

put-bucket-logging

create:logging

aws s3api put-bucket-logging --bucket infraqa-test-bubble --policy file://policy.json

put-bucket-metrics-configuration

create:metrics

aws s3api put-bucket-metrics-configuration --bucket infraqa-test-bubble --id 123 --metrics-configuration '{"Id": "123", "Filter": {"Prefix": "logs"}}'

put-bucket-notification-configuration

create:notification

aws s3api put-bucket-notification-configuration --bucket infraqa-test-bubble --notification-configuration file://notification.json

put-bucket-policy

create:policy

aws s3api put-bucket-policy --bucket infraqa-test-bubble --policy file://bucket_policy.json

put-bucket-replication

create:replication

aws s3api put-bucket-replication --bucket infraqa-test-bubble --replication-configuration file://replication.json

put-bucket-request-payment

create:requestPayment

aws s3api put-bucket-request-payment --bucket infraqa-test-bubble --request-payment-configuration '{"Payer":"BucketOwner"}'

put-bucket-tagging

create:tagging

aws s3api put-bucket-tagging --bucket infraqa-test-bubble --tagging 'TagSet=[{Key=organization,Value=marketing}]'

put-object-tagging

create:tagging

put-bucket-versioning

create:versioning

aws s3api put-bucket-versioning --bucket infraqa-test-bubble --versioning-configuration Status=Enabled

put-bucket-website

create:website

aws s3api put-bucket-website --bucket infraqa-test-bubble --website-configuration file://website.json

create-bucket

create

aws s3api create-bucket --bucket infraqa-test-bubble

head-bucket

permcheck

aws s3api head-bucket --bucket infraqa-test-bubble

head-object

permcheck

aws s3api head-object --bucket infraqa-test-bubble --key 'file data/data/format=csv/sample/variety/sample_with_dot_data.csv'

copy-object

read [src file] create [dst file]

aws s3api copy-object --copy-source 'infraqa-test/file data/data/format=csv/sample/variety/sample_with_dot_data.csv' --key 'file data/output/format=csv/sample/variety/sample_with_dot_data.csv' --bucket infraqa-test-bubble

create-multipart-upload

update

aws s3api create-multipart-upload --bucket infraqa-test-bubble --key 'file data/output/format=csv/sample/variety/sample_with_dot_data.csv'

restore_object

update

aws s3api restore-object --bucket infraqa-test-bubble --key 'file data/output/format=csv/sample/variety/sample_with_dot_data.csv'

ls

permcheck

aws s3 ls

mb

create

aws s3 mb s3://infraqa-test-bubble --region us-east-1

mv

permcheck read [src file] create [dst file] delete [src file]

aws s3 mv 's3://infraqa-test-bubble/file data/output/format=csv/sample/variety/' 's3://infraqa-test-bubble/file data/output/format=csv/sample/variety_2/' --recursive

rb

query:list-type delete

aws s3 rb s3://infraqa-test-bubble --force

rm

delete query:list-type

aws s3 rm 's3://infraqa-test-bubble/file data/output/format=csv/sample/variety/' --recursive

sync

website

create:website

aws s3 website s3://infraqa-test-bubble / --index-document index.html --error-document error.html

cp

permcheck read [src file] create [dst file]

aws s3 cp 's3://infraqa-test/file data/data/format=csv/sample/variety/sample_with_dot_data.csv' 's3://infraqa-test-bubble/file data/output/format=csv/sample/variety/'