John, and welcome back.
Now in today's video, we'll be discussing about the three bucket policy now when we discuss about granting
permission to a specific S3 resource, there are two primary ways in which the permissions can be granted.
So let's assume that you have a three bucket.
So based on this estimate, there are two primary ways in which the permissions are granted.
First one is through the identity policies and second one is through the bucket policies.
So the identity policies are the policies that are directly associated with the IAM user and group and
I am role.
So those are basically the identity policies.
The second one is the bucket policy, which are also a very important one in terms of the overall access
management for a three resource.
And in today's We Do, our primary aim is to understand about the bucket policies in great detail.
Now, before we proceed, let's take a simple use case where you have an user named Bob and Bob needs
full access to a specific S3 bucket.
Now, this is a very simple use case.
And the way in which this use case can be achieved is you create a three full access and policy.
And what you do, you associate that and policy with the Bob Iam user and then the user will be able
to successfully connect with the S3 bucket.
Now, in this specific use case, you'll see the overall scope is still at the user level.
So the IAM user level and hence you can go ahead and easily solve it with the identity policies.
But there are a lot of use cases with identity policies will not really help, primarily with the scope
is much more wider beyond the typical IEM identity policy entity.
So let's quickly understand that.
So let's say that you have a three bucket and now what you want is you want all the users across the
Internet, all of the users should be able to connect to the S3 bucket.
So for this use case, you will see that the overall scope of our mission is wider than that of the
typical IIIB identity based policy entities.
Now, one of the questions that comes is why do you need the entire Internet to connect to a three bucket?
In fact, there are a lot of use cases where this is required.
One of the typical example is that organization might be hosting their entire website on a three bucket.
So as three also supports static Web hosting.
And if the organization has a static website, they might host it industry bucket and everyone across
the Internet will be able to access it.
So this is one of the examples many organizations they make use of as three bucket to host a certain
binaries which everyone across the Internet should be able to download.
So a lot of use cases are available and these use cases are typically beyond the scope of the identity
policy entity.
And in order to achieve this use case, we make use of the bucket policy.
So at a very high level overview, a bucket policy is a resource to be and policy associated with the
S3 bucket to control the access permissions for the bucket and objects inside it.
So you have a three bucket and associated with the same bucket.
You have certain as three bucket policy tools.
So let's look into the simple rules.
Oriya Fossilise allow access from the entire Internet.
This is something that we were discussing then.
You can also have it is granular rules like allow access from only 10 Seventy-Seven 3.0 in the IP address.
This is also something that cannot be achieved with the help of identity policies.
This is achievable with the help of market policy.
Third example is only allow access from a specific PPC.
Let's say you have five pieces within the account.
However, you only need one Lepke to access the registry market.
So this use case can also be achieved with the help of market policies.
Then you have one more use case, let's say that only allow EU connection.
So let's say you have some files within the EU, but now Extra supports both the EU as well as the EDP
misconnections.
So you want only HD connections to connect to the market.
So in order to achieve this use case also you will need to make use of the S3 market policies.
So let's do one thing.
Let's jump into practical and understand things in more detail.
So currently, with industry Consolidated Gordon quickly create a new bucket.
The bucket list is called as my Kepi LAVs hyphen policy.
Let's go back down and we'll create a bucket.
Great.
So Arrester Bucket is created.
Let's quickly open this up and within the bucket.
By default, there is no bucket policy that is associated with it, so it will quickly go to the permissions.
Let's go down now.
You have an option for bucket policy and currently you see there is no policy that is associated with
it.
So into this video will be taking up three different use cases related to the bucket policy and will
look into how things work there.
So the first use case is a.
He did with a public access, so the U.S. states that we have certain files that are stored in a street
market and we want that files to be available across the entire Internet.
Now, let's look into some real world use cases related to this specific criteria.
Now, currently MTW certification.
We are just taking an example of a certified security specialty certification page.
Now, within a year, you have to download a guide and download sample questions.
So let's open up the download exam, Gadir, and you'll see that we have a PDF document that automatically
got loaded.
And this PDF document is in fact stored in these three Buckett.
So anyone across the Internet, when he clicks on the exam guide, he'll be able to see the entry exam
guide within the browser.
Now, another question that comes is, how do I know that this is stored in.
Yes, let's find it out.
So I go for this are audit and from Mozilla, if I quickly do a Google hyphen, I on this specific URL,
you will see the EDP response headers and one of the response headers, you see you have a server of
Amazon history.
So this file is basically stored in S3 and they are also making use of a cloud distribution.
So you see for the cache header we are getting a hit from Cloud Franscell, S3 and Cloud are being used
for serving this file.
So far, our first use case, we want to store some data in the three bucket and that data similar to
this PDF should be available for the entire Internet.
That's correct.
So now let's do one thing.
Let's go to the objects here will go ahead and upload a new file.
Let's either file and I have an image file.
Call Mr. Kuroda Jipping.
So we'll be using this for our testing purposes.
So let me go ahead and upload this image file.
Great.
So we have Mr. Prototypic available in distribution.
So that's you curiosity.
Mr. Crawdaddy basically has a image of this group.
So here's is my new friend.
He visits my place every day for a nice, delicious breakfast.
So we'll be using this image and Mr. Grove will ensure that we understand the history, Buckett policies
in great detail.
Great.
Now, at this stage, when you quickly open the object Aurier, you basically get the object you are.
So this object are let's say when you type it within the browser, you immediately you get access denied.
Now, there are multiple reasons why the overall access denied message comes.
So let's do one thing.
Let's go back to our bucket.
And within the permission step, you have a block public access.
So this is something that we want to remove.
So let's go ahead and be selected and conceive.
Let's look and feel great.
Now, at this stage, the block all public accesses of so evidentiality access object can be public.
So in this case, if I quickly refresh this page and you see we're still getting access denied a message.
So what we need to do is we need to associate a new S3 bucket policy that allows the gate operation
from the entire director.
So if you look into the policy statement, so this is the complete policy within here, the effect is
allow the principle to start and the action is gate object.
So that basically means everyone will be allowed to by the former gate object operation on the resource
with this specific area.
So let's copy this bucket policy and within our bucket list, go to permissions within the bucket policy
will quickly do an edit.
And within that, let me in fact maximize the feed so that it is viewable and I'll pass the bucket policy.
Let's zoom in once more.
So within year, one of the important part is the bucket, they added.
So what you need to do is you have to replace this bucket here anyway.
All right.
So once you have this bucket policy, everyone across the Internet will be able to perform a great object
operation on all of the objects inside the Mike Epilepsia fan policy bucket list.
So let's zoom out and do see changes.
And now within you, you see it states publicly accessible.
So let me do a FAA and we have the Mr Cruz congratulating us for our first successful bucket policy.
So I hope with this you understood the basics of a three bucket policy.
So let's do one thing.
Let's go ahead and look into a few more use cases.
So the second use case is associated with allowing only the EPA connections.
So generally within the S3 bucket, what the EPA as well as the EPA is connections are allowed.
So the U.S. states that only.
Said request should be allowed to EPA says, where you have the encryption in transit that takes place
so all the EPA requests should be blocked.
So if you look into the bucket policy, it is pretty straightforward here.
So similar to the previous policy where we allowed the principle of start on, get the object.
Similarly, you're allowing the principle of start on that object.
The only additional thing here is the condition.
And what you have in condition is an unsecured transport is true.
So that basically means if the connection is present, then only this will apply.
If this condition is not met, then this specific rule will not apply.
Great.
So within our policy to associated with allowing this to GPS, this is very similar.
So let's do one thing.
Let's go ahead and try on.
Now, before we try it, let's quickly verify whether HTP in a suit is Motorola.
Now, if you look into the request that is made, the Google Chrome browser basically makes the EPA
request authority and hence it states that the connection is secure.
Now, from this year, whenever you make a request, let's make a request towards the EPA in point,
Daudier, and we're getting a 200, OK, similar to this.
Let's also make a request to the deep end point over here.
And you see, even for the EPA in point, we are getting a 200.
Okay, so this basically means both the EPA needs to replace endpoints that allowed here.
So in order to work on this, let's quickly create our own policy.
So let's edit our earlier policy year will copied our bucket name and let's replace it within our policy.
I'll copy the entire policy and let's be straight here.
Will do a safe change.
Perfect.
So in order to verify things are working first, let's send a request to the EPA saying pointier.
And as expected, the request is getting a 200.
Okay.
Now, let's send a request to the EPA in point now.
So you see for the EPA endpoint immediately, we are getting a four zero three four billion, Greg.
So I hope with this you understood the basics of the bucket policy, too.
So let's do one thing.
Let's conclude, as of now, we also have a very interesting -- policy, number three that we will
be discussing in the next days.
Otherwise, this video will go a bit long.
So the bucket policy three will give us great knowledge.
However, this is something that will reserve what next video.
So with this will conclude today's video.
And again, I encourage you to go ahead and try this out.
These are very interesting as well as important things that you will see in real world scenarios.