Instructor: Okay.
So now let's talk about S3 Access Points
and to make it easier,
I will start with the diagram.
So let's say we have a buckets
and in this bucket we have different folders.
For example, we have a finance folder,
we have a sales folder and so on.
And so we know that we can restrict access
to different folders
based on a bucket policy.
And so the buckets policy can be quite simple,
but as soon as we have more users and more groups,
for example, the finance group, the sales group,
and the analytics group,
it can become quite complicated
to regulate who can access to what?
And the bucket policy can get really, really, really big.
So the solution to that is to create access points.
So access points can be defined outside
of your buckets
and the access points are going to be linked
to a specific part of your bucket.
For example, the finance access points
will give access only to the finance data
in the finance folder.
And the sales access points is going to give access
only to the sales data in the sales folder
and the analytics access point that you create as well
could have access to both these folders
because analytics people need to analyze
all these data at once.
So the idea is now the finance user group
has access directly
only to the finance access point
and through the finance access point
will get read-write access to the finance data.
The sales access points, group will be given access
to the sales access points again,
and with a specific policy,
will get access for read-write to the sales data.
And this time the analytics team
will only get read access to all the buckets
through their own analytics access points,
which makes sense.
So each access points will have its own DNS okay?
So the bucket will not be accessed through the normal DNS
of the S3 bucket,
but through its own DNS of the access points.
And there will be a policy with each access points
to limit who can access this access point.
So it could be a specific IAM or user group,
and it could be one policy per access point.
That mean it's going to be a lot easier to manage
than complex bucket policies.
So without the access points,
you have a master bucket policy
with all the rules written in it,
but with access points,
each access point will have its own bucket policy.
So it becomes way easier to make sense of who can do what.
You can also restrict traffic from a specific VPC
on each access points for private access.
And the access points are going to be linked
to a unique specific buckets,
which is a unique name per accounts region okay?
So let's have a look at how access points
work in the console.
So let's go ahead and create an access point.
And for this on the left hand side,
I have the access point direct menu.
And in here I can create an access point.
So I'll call this one demoaccesspoints,
and then you have to specify a bucket name.
So I can specify
the demo-s3-event-stephane,
in my bucket,
the region is determined by my bucket location.
So EU-West-1,
and then the network origin for this access point.
So is this a VPC access or is this an internet access?
Now if you specify the VPC access,
that mean that you want all the traffic
to be coming from within your VPC.
So you want it to remain privates.
In which case,
while the S3 Console doesn't support accessing
the S3 bucket resource,
using the VPCs access points,
and you need to use the API.
If you specify VPC unit,
you obviously specify VPC ID,
but I wanna a demo so I have to use,
so I will use the internet
and in the internet,
I will be able to access my access point publicly.
Next, do we want to block public access
settings for this access point?
So we have the same setting as your S3 buckets
and then the access point policy,
which is written in JSON
and will provide access to the object stored.
So let's look at some examples
for policies for access points.
So let's say we want to ensure
that this bucket name right here
is only accessed through a access point policy,
and it will only give access to a sub folder.
So for this,
I can go into the policies example
and I will scroll down.
So I will click on access point policies examples,
and then I will show you the first step.
So the first step is to create
an access point policy grants
and so I'm going to copy this
and paste it.
And if you look at the statements,
so we allow a specific user, for example,
I can take my account ID in here
and say, the user is Stephane
is only going to be able to do GetObject
and put objects
on and then you just specify the proper region.
So it's you EU-West-1
the account ID again is here
access points, okay?
And here is the name of the access point I have.
So I'll just copy this name right here
and call it to my access points,
access point name,
and then objects,
stephanestar.
So this is going to only allow me
to write to the directory stephanestar,
which is, I think pretty cool.
And so this is the access points policy.
So now it's been applied and
I can access this access point right here.
And as you can see, it took me directly into the
demo-s3-event-stephane buckets
and it created an access points
as well in here.
So my access point is not linked to my buckets.
And what I can do is that I can
go now to my buckets permissions
and change the bucket policy.
Why?
Well, because we've created an access point in here.
And that means that if we access our S3 buckets
through this access point in my stephane user,
access it through this access point,
then it's only going to be allowed
to access a specific user directory.
But my user is stephane
could still access my buckets
through the buckets directly.
So what I need to do
is go into permissions and create
a bucket policy that will be blocking
any access other than access points
and to do so you click
on delegating access control to access points,
and then you need to paste that buckets policy in.
So let's do it.
So we'll edit this bucket policy
and paste it,
and in this example, we're saying, okay,
allow any one, okay?
Any action on the bucket ARN.
So once you get the bucket ARN right here.
So the resources, this one,
and then this one slash star, okay?
As long as the access point accounts
is using the buckets account ID.
So here it is,
I'm going to paste this in,
so effectively what we're seeing is that
this S3 buckets can only be accessed
if you are using an access points coming from this accounts.
And this is the current accounts.
So this is good because now what we're doing
is that we're saying,
hey, you can only access this buckets, okay?
Through the access points.
And now you can define as many access points as you want
directly in your user credit one,
but I could create another one.
And then through the access points,
as you can see,
we can view the buckets and so on,
and there's going to be a specific ARN
for this access point.
So that's it for this lecture.
We've seen access points in details.
I hope you liked it.
And I will see you in the next lecture.