Assigning an access policy in Object Storage for a service connection

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id options.

1. See the description of the CLI command for updating bucket settings:

   yc storage bucket update --help
   

2. Describe your bucket policy configuration as a JSON data schema:

   {
     "Version": "2012-10-17",
     "Statement": {
       "Effect": "Allow",
       "Principal": "*",
       "Action": "*",
       "Resource": [
         "arn:aws:s3:::<bucket_name>/*",
         "arn:aws:s3:::<bucket_name>"
       ],
       "Condition": {
         "StringEquals": {
           "yc:private-endpoint-id": "<connection_ID>"
         }
       }
     }
   }
   

   Where:

   • <bucket_name>: Name of the bucket in Object Storage to which you need to apply the access policy, e.g., my-s3-bucket.
   • <connection_ID>: Service connection ID (private endpoint), e.g., enpd7rq1s3f5********.

3. Save the final configuration to a file named policy.json.

4. Run this command:

   yc storage bucket update \
     --name <bucket_name> \
     --policy-from-file <policy_file_path>
   

   Once the bucket policy is applied, you can access the bucket only from the VPC cloud network in which you created the relevant service connection (private endpoint).

If you do not have the AWS CLI yet, install and configure it.

1. Describe your bucket policy configuration as a JSON data schema:

   {
     "Version": "2012-10-17",
     "Statement": {
       "Effect": "Allow",
       "Principal": "*",
       "Action": "*",
       "Resource": [
         "arn:aws:s3:::<bucket_name>/*",
         "arn:aws:s3:::<bucket_name>"
       ],
       "Condition": {
         "StringEquals": {
           "yc:private-endpoint-id": "<connection_ID>"
         }
       }
     }
   }
   

   Where:

   • <bucket_name>: Name of the bucket in Object Storage to which you need to apply the access policy, e.g., my-s3-bucket.
   • <connection_ID>: Service connection ID (private endpoint), e.g., enpd7rq1s3f5********.

2. Save the final configuration to a file named policy.json.

3. Run this command:

   aws s3api put-bucket-policy \
     --endpoint https://storage.yandexcloud.net \
     --bucket <bucket_name> \
     --policy file://policy.json
   

Once the bucket policy is applied, you can access the bucket only from the VPC cloud network in which you created the relevant service connection (private endpoint).

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

By default, Terraform uses an IAM token for authentication in Object Storage. In addition to an IAM token, you can use a service account and static access keys for authentication in Object Storage. For more information about Terraform authentication in Object Storage, see the relevant provider documentation.

1. Open the Terraform configuration file and specify the policy using the yandex_storage_bucket_policy resource:

   resource "yandex_storage_bucket_policy" "bpolicy" {
     bucket = "my-policy-bucket"
     policy = <<POLICY
   {
     "Version": "2012-10-17",
     "Statement": {
       "Effect": "Allow",
       "Principal": "*",
       "Action": "*",
       "Resource": [
         "arn:aws:s3:::<bucket_name>/*",
         "arn:aws:s3:::<bucket_name>"
       ],
       "Condition": {
         "StringEquals": {
           "yc:private-endpoint-id": "<connection_ID>"
         }
       }
     }
   }
   POLICY
   }
   

   Where:

   • <bucket_name>: Name of the bucket in Object Storage to which you need to apply the access policy, e.g., my-s3-bucket.
   • <connection_ID>: Service connection ID (private endpoint), e.g., enpd7rq1s3f5********.

   For more information about yandex_storage_bucket_policy properties, see this provider guide.

2. Apply the changes:

   1. In the terminal, go to the directory where you edited the configuration file.

   2. Make sure the configuration file is correct using this command:

      terraform validate
      

      If the configuration is correct, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a detailed list of resources. No changes will be made at this step. If the configuration contains any errors, Terraform will show them.

   4. Apply the changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   You can check the update using the management console.

To configure a bucket policy, use the update REST API method for the Bucket resource, the BucketService/Update gRPC API call, or the PutBucketPolicy S3 API method. If the bucket already had a bucket policy configured, it will be completely overwritten once you apply the new policy.