Dell ObjectScale 1.3 Administration Guide

PDF

Actions in IAM Policy

This section describes all the supported actions in IAM policies that allow system account users or IAM users to perform operations.

Actions supported for system account user

Table 1. AccountThe table describes the actions for accounts with description, access level, resource type and condition keys.
Action	Description	Access Level	Resource Type (* required)	Condition Keys
account:*	All account actions.	N/A	-	-
account:CreateAccount	Create an account in ObjectScale instance.	Write	-	-
account:UpdateAccount	Update account configuration.	Write	-	-
account:ListAccounts	List all accounts created in all ObjectScale instances.	List	-	-
account:GetAccount	Retrieves information about the specified account.	Read	-	-
account:DeleteAccount	Delete the specified account.	Write	-	-
account:AssociateAccountToObjectStore	Associate account to object store.	Write	-	If required, can support below condition key. account:objectStoreId
account:UnassociateAccountToObjectStore	Disassociate account from object store.	Write	-	-

Table 2. GrafanaThe table describes the actions for Grafana with description, access level, resource type and condition keys.
Action	Description	Access Level	Resource Type (* required)	Condition Keys
grafana:*	Grant all access for all object store operations.	*	-	-

Table 3. Object storeThe table describes the actions for object store with description, access level, resource type and condition keys.
Action	Description	Access Level	Resource Type (* required)	Condition Keys
objectstore:*	Grant access for all object store operations.	*	-	-
objectstore:Get*	Grant read access to object store.	Read	-	-
objectstore:Write*	Grant write access to object store.	Write	-	-

Table 4. InfluxDBThe table describes the actions for InfluxDB with description, access level, resource type and condition keys.
Action	Description	Access Level	Resource Type (* required)	Condition Keys
influxdb:*	Grant all influxdb operations.	*	-	-
influxdb:Get*	Grant influxdb read.	Read	-	-
influxdb:Write*	Grant influxdb write.	Write	-	-

Table 5. AlertThe table describes the actions for Alert with description, access level, resource type and condition keys.
Action	Description	Access Level	Resource Type (* required)	Condition Keys
Alert:*	Allows system account user to perform all alert operations.	*	-	-

Actions supported for IAM identities

IAM user, role, and group support these actions.

Table 6. IAM entity managementThe table describes the actions supported for IAM identities with description, access level, resource type and condition keys.
Action	Description	Access Level	Resource Type (* required)	Condition Keys
iam:AddUserToGroup	Adds an IAM user to the specified IAM group.	Write	group*	-
iam:AttachGroupPolicy	Attaches a specified managed policy to the specified IAM group.	Permissions management	group*	iam:PolicyARN
iam:AttachRolePolicy	Attaches a specified managed policy to the specified IAM role.	Permissions management	role*	iam:PolicyARN iam:PermissionsBoundaryiam:ResourceTag/${TagKey}
iam:AttachUserPolicy	Attaches a specified managed policy to the specified IAM user.	Permissions management	user*	iam:PolicyARN iam:PermissionsBoundary iam:ResourceTag/${TagKey}
iam:CreateAccessKey	Creates a new secret access credential for a specified IAM user.	Write	user*	-
iam:CreateGroup	Creates a IAM group in the namespace.	Write	group*	-
iam:CreatePolicy	Creates a new managed policy in the namespace.	Permissions management	policy*	-
iam:CreatePolicyVersion	Creates a version of the specified managed policy in namespace.	Permissions management	policy*	-
iam:CreateRole	Creates a IAM role in the namespace.	Write	role*	iam:PermissionsBoundary
iam:CreateSAMLProvider	Creates a SAML 2.0 identity provider (IdP) in the namespace.	Write	saml-provider*	-
iam:CreateUser	Creates an IAM user in namespace.	Write	user*	iam:PermissionsBoundary
iam:DeleteAccessKey	Deletes the specified access key credentials that are associated with the specified IAM user.	Write	user*	-
iam:DeleteGroup	Deletes the specified IAM group from the namespace.	Write	group*	-
iam:DeleteGroupPolicy	Deletes the specified inline policy from its group.	Permissions management	group*	-
iam:DeletePolicy	Deletes the specified managed policy.	Permissions management	policy*	iam:PolicyARN
iam:DeletePolicyVersion	Deletes the specified version from the managed policy.	Permissions management	policy*	-
iam:DeleteRole	Grants permission to delete the specified role.	Write	role*	-
iam:DeleteRolePermissionsBoundary	Deletes the permissions boundary for the specified IAM role.	Permissions management	role*	iam:PermissionsBoundaryiam:ResourceTag/${TagKey}
iam:DeleteRolePolicy	Deletes the specified inline policy from its role.	Permissions management	role*	iam:PermissionsBoundary
iam:DeleteSAMLProvider	Deletes a specified SAML provider.	Write	saml-provider*	-
iam:DeleteUser	Deletes the specified IAM user from the namespace.	Write	user*	iam:ResourceTag/${TagKey}
iam:DeleteUserPermissionsBoundary	Deletes the permissions boundary for the specified IAM user.	Permissions management	user*	iam:PermissionsBoundaryiam:ResourceTag/${TagKey}
iam:DeleteUserPolicy	Deletes the specified inline policy from its user.	Permissions management	user*	iam:PermissionsBoundary iam:ResourceTag/${TagKey}
iam:DetachGroupPolicy	Detach a specified managed policy from the specified IAM group.	Permissions management	group*	-
iam:DetachRolePolicy	Detach a specified managed policy from the specified IAM role.	Permissions management	role*	iam:PolicyARN iam:PermissionsBoundaryiam:ResourceTag/${TagKey}
iam:DetachUserPolicy	Detach a specified managed policy from the specified IAM user.	Permissions management	user*	iam:PolicyARN iam:PermissionsBoundaryiam:ResourceTag/${TagKey}
iam:GetAccessKeyLastUsed	Retrieves best effort information about when the specified access key was last used.	Read	user*	-
iam:GetContextKeysForCustomPolicy	Retrieves a list of all the context keys that are referenced in the input policies.	Read	-	-
iam:GetContextKeysForPrincipalPolicy	Detach a specified managed policy from the specified IAM entity.	Read	user, group, role	-
iam:GetGroup	Retrieves a list of IAM users that are in the specified IAM group. You can paginate the results using the MaxItems and Marker parameters.	Read	group*	-
iam:GetGroupPolicy	Gets the specified inline policy document from the specified IAM group.	Read	group*	-
iam:GetPolicy	Retrieves information about the specified managed policy.	Read	policy*	-
iam:GetPolicyVersion	Retrieve information about a version of the specified managed policy.	Read	policy*	-
iam:GetRole	Retrieves information about the specified role.	Read	role*	iam:ResourceTag/${TagKey}
iam:GetPolicy	Retrieves information about specified managed policy.	Read	policy*	-
iam:GetPolicyVersion	Retrieves information about specified version of the managed policy.	Read	policy*	-
iam:GetRolePolicy	Retrieves the specified inline policy document that is embedded with the specified IAM role.	Read	role*	iam:ResourceTag/${TagKey}
iam:GetSAMLProvider	Retrieves the SAML provider metadata document that is associated with the IAM SAML provider resource.	Read	saml-provider*	-
iam:GetUser	Retrieves information about the specified IAM user.	Read	user*	iam:ResourceTag/${TagKey}
iam:GetUserPolicy	Retrieves the specified inline policy document of the specified IAM user.	Read	user*	iam:ResourceTag/${TagKey}
iam:ListAccessKeys	Lists information about the access key IDs that are associated with the specified IAM user.	List	user*	-
iam:ListAttachedGroupPolicies	Lists all managed policies that are attached to the specified IAM group.	List	group*	-
iam:ListAttachedRolePolicies	Lists all managed policies that are attached to the specified IAM role.	List	role*	iam:ResourceTag/${TagKey}
iam:ListAttachedUserPolicies	Lists all managed policies that are attached to the specified IAM user.	List	user*	iam:ResourceTag/${TagKey}
iam:ListEntitiesForPolicy	Lists all entities (IAM users, groups, and roles) that are attached to the specified managed policy.	List	policy*	-
iam:ListGroupPolicies	List the names of the inline policies that are in the specified IAM group.	List	group*	-
iam:ListGroups	List the IAM groups that have the specified path prefix.	List	-	-
iam:ListGroupsForUser	List the IAM groups that the provided IAM user belongs to.	List	user*	iam:ResourceTag/${TagKey}
iam:ListPolicies	Lists all managed policies that are associated with the namespace.	List	-	-
iam:ListPolicyVersions	Lists information about the versions of the requested managed policy.	List	policy*	-
iam:ListRolePolicies	Lists the names of the inline policies that are in the specified IAM role.	List	role*	iam:ResourceTag/${TagKey}
iam:ListRoles	Lists the IAM roles that have the specified path prefix.	List	-	-
iam:ListRoleTags	Lists the tags that are attached to the specified role.	List	role*	iam:ResourceTag/${TagKey}
iam:ListSAMLProviders	Lists the SAML providers that are in the namespace.	List	-	-
iam:ListUserPolicies	Lists the names of the inline policies that are in the specified IAM user.	List	user*	iam:ResourceTag/${TagKey}
iam:ListUsers	Lists the IAM users that have the specified path prefix.	List	-	-
iam:ListUserTags	Lists the tags that are attached to the specified user.	List	user*	iam:ResourceTag/${TagKey}
iam:PutGroupPolicy	Adds or updates an inline policy document to the specified IAM group.	Permissions management	group*	-
iam:PutRolePermissionsBoundary	Sets or updates the provided managed policy as the roles permissions boundary.	Permissions management	role*	iam:PermissionsBoundaryiam:ResourceTag/${TagKey}
iam:PutRolePolicy	Adds or updates an inline policy document to the specified IAM role.	Permissions management	role*	iam:PermissionsBoundaryiam:ResourceTag/${TagKey}
iam:PutUserPermissionsBoundary	Sets or updates the provided managed policy as the permissions boundary of a user.	Permissions management	user*	iam:PermissionsBoundaryiam:ResourceTag/${TagKey}
iam:PutUserPolicy	Adds or updates an inline policy document to the specified IAM user.	Permissions management	user*	iam:PermissionsBoundaryiam:ResourceTag/${TagKey}
iam:RemoveUserFromGroup	Removes an IAM user from the specified group.	Write	group*	-
iam:SetDefaultPolicyVersion	Sets the specified version of the policy as default.	Permissions management	policy*	-
iam:SimulateCustomPolicy	Simulates how IAM policies and optionally a resource-based policy works with a list of API operations and ObjectScale resources to determine the effective permissions of the policy.	Read	-	-
iam:SimulatePrincipalPolicy	Simulates how IAM policies that are attached to an IAM entity (user, group, or role) works with a list of API operations and ObjectScale resources to determine the effective permissions of the policy.	Read	user, group, role	-
iam:TagRole	Adds tags to an IAM role.	Tagging	role*	-
iam:TagUser	Adds tags to an IAM user.	Tagging	user*	-
iam:UntagRole	Removes tags from specified IAM role.	Tagging	role*	iam:ResourceTag/${TagKey}
iam:UntagUser	Removes tags from specified IAM user.	Tagging	user*	iam:ResourceTag/${TagKey}
iam:UpdateAccessKey	Updates the status of specified access keys as Active or Inactive.	Write	user*	-
iam:UpdateAssumeRolePolicy	Updates the policy that grants an IAM entity permission to assume a role.	Permissions management	role*	iam:ResourceTag/${TagKey}
iam:UpdateRole	Updates the description or maximum session duration setting of an IAM role.	Write	role*	iam:ResourceTag/${TagKey}
iam:UpdateSAMLProvider	Updates the metadata document for an existing SAML provider.	Write	saml-provider*	-

Table 7. STSThe table describes the actions supported for STS with description, access level, resource type and condition keys.
Action	Description	Access Level	Resource Type (* required)	Condition Keys
sts:AssumeRole	Returns temporary security credentials for accessing ObjectScale resources that you might not have access to.	Write	role*	aws:RequestTag/${TagKey} aws:TagKeys aws:PrincipalTag/${TagKey}
sts:AssumeRoleWithSAML	Returns temporary security credentials for users who authenticated using a SAML authentication response.	Write	role*	aws:RequestTag/${TagKey} aws:TagKeys aws:PrincipalTag/${TagKey} saml:iss saml:aud saml:sub saml:sub_type saml:edupersonorgdn saml:namequalifier
sts:GetFederationToken	Returns temporary security credentials (consisting of an access key ID, a secret access key, and a security token).	Read	user*	aws:PrincipalTag/${TagKey} aws:PrincipalArn aws:username aws:userid aws:PrincipalAccount

Table 8. S3The table describes the actions supported for S3 with description, access level, resource type and condition keys.
Action	Description	Access Level	Resource Type (* required)	Condition Keys
New operations supported by S3 service:
s3:GetReplicationConfiguration	Grants permission to get the replication configuration information set on an amazon S3 bucket.	Read	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:PutReplicationConfiguration	Grants permission to create a replication configuration or replace an existing one.	Write	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:DeleteReplicationConfiguration	Grants permission to delete a replication configuration.	Write	bucket*	-
s3:GetBucketObjectLockConfiguration	Grants permission to get the object lock configuration of an amazon S3 bucket.	Read	bucket*	s3:authType s3:signatureversion
s3:PUTBucketObjectLockConfiguration	Grants permission to get the object lock configuration of an amazon S3 bucket.	Write	bucket*	s3:authType s3:signatureversion
s3:GetObjectLegalHold	Grants permission to get the current legal hold status of an object.	Read	object*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:PutObjectLegalHold	Grants permission to apply a legal hold configuration to a specified object.	Write	object*	s3:authType s3:signatureversion s3:x-amz-content-sha256 s3:object-lock-legal-hold
s3:GetObjectRetention	Grants permission to retrieve the retention settings for an object.	Read	object*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:PutObjectRetention	Grants permission to place an object retention configuration on an object.	Write	object*	s3:authType s3:signatureversion s3:x-amz-content-sha256 s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days
s3:BypassGovernanceRetention	Grants permission to allow circumvention of governance-mode object retention settings.	Permission Management	object*	s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:signatureversion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-storage-class s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days s3:object-lock-legal-hold
Existing S3 operations supported by S3 service:
s3:AbortMultipartUpload	Grants permission to cancel a multipart upload.	Write	object*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:CreateBucket	Grants permission to create a bucket.	Write	bucket*	s3:authType s3:signatureversion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp
s3:DeleteBucket	Grants permission to delete the bucket named in the URI.	Write	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:DeleteBucketPolicy	Grants permission to delete policy on a specified bucket.	Permission Management	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:DeleteObject	Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object.	Write	object*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:DeleteObjectTagging	Grants permission to use the tagging subresource to remove the entire tag set from the specified object.	Tagging	object*	s3:ExistingObjectTag/<key> s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:DeleteObjectVersion	Grants permission to remove a specific version of an object.	Write	object*	s3:authType s3:signatureversion s3:versionid s3:x-amz-content-sha256
s3:DeleteObjectVersionTagging	Grants permission to remove the entire tag set for a specific version of the object.	Tagging	object*	s3:ExistingObjectTag/<key> s3:authType s3:signatureversion s3:versionid s3:x-amz-content-sha256
s3:GetBucketAcl	Grants permission to use the ACL subresource to return the access control list (ACL) of an Amazon S3 bucket.	Read	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:GetBucketCORS	Grants permission to return the CORS configuration information set for an Amazon S3 bucket.	Read	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:GetBucketPolicy	Grants permission to return the policy of the specified bucket.	Read	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:GetBucketTagging	Grants permission to return the tag set associated with an Amazon S3 bucket.	Read	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:GetBucketVersioning	Grants permission to return the versioning state of an Amazon S3 bucket.	Read	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:GetLifecycleConfiguration	Grants permission to return the life-cycle configuration information set on an Amazon S3 bucket.	Read	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:GetObject	Grants permission to retrieve objects from Amazon S3.	Read	object*	s3:ExistingObjectTag/<key> s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:GetObjectAcl	Grants permission to return the access control list (ACL) of an object.	Read	object*	s3:ExistingObjectTag/<key> s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:GetObjectTagging	Grants permission to return the tag set of an object.	Read	object*	s3:ExistingObjectTag/<key> s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:GetObjectVersion	Grants permission to retrieve a specific version of an object.	Read	object*	s3:ExistingObjectTag/<key> s3:authType s3:signatureversion s3:versionid s3:x-amz-content-sha256
s3:GetObjectVersionAcl	Grants permission to return the access control list (ACL) of a specific object version.	Read	object*	s3:ExistingObjectTag/<key> s3:authType s3:signatureversion s3:versionid s3:x-amz-content-sha256
s3:GetObjectVersionTagging	Grants permission to return the tag set for a specific version of the object.	Read	object*	s3:ExistingObjectTag/<key> s3:authType s3:signatureversion s3:versionid s3:x-amz-content-sha256
s3:ListAllMyBuckets	Grants permission to list all buckets owned by the authenticated sender of the request.	List	-	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:ListBucket	Grants permission to list some or all the objects in an Amazon S3 bucket (up to 1000).	List	bucket*	s3:authType s3:delimiter s3:max-keys s3:prefix s3:signatureversion s3:x-amz-content-sha256
s3:ListBucketMultipartUploads	Grants permission to list in-progress multipart uploads.	Read	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:ListBucketVersions	Grants permission to list metadata about all the versions of objects in an Amazon S3 bucket.	Read	bucket*	s3:authType s3:delimiter s3:max-keys s3:prefix s3:signatureversion s3:x-amz-content-sha256
s3:ListMultipartUploadParts	Grants permission to list the parts that have been uploaded for a specific multipart upload.	Read	object*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:PutBucketAcl	Grants permission to set the permissions on an existing bucket using access control lists (ACLs).	Permission Management	bucket*	s3:authType s3:signatureversion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp
s3:PutBucketCORS	Grants permission to set the CORS configuration for an Amazon S3 bucket.	Write	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:PutBucketPolicy	Grants permission to add or replace a bucket policy on a bucket.	Permission Management	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:PutBucketTagging	Grants permission to add tags to an existing Amazon S3 bucket.	Tagging	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:PutBucketVersioning	Grants permission to set the versioning state of an existing Amazon S3 bucket.	Write	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:PutLifecycleConfiguration	Grants permission to create a life-cycle configuration for the bucket or replace an existing life-cycle configuration.	Write	bucket*	s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:PutObject	Grants permission to add an object to a bucket.	Write	object*	s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:signatureversion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-copy-source s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-metadata-directive s3:x-amz-server-side-encryption s3:x-amz-server-side-encryption-aws-kms-key-id s3:x-amz-storage-class s3:object-lock-mode s3:object-lock-retain-until-date s3:object-lock-remaining-retention-days s3:object-lock-legal-hold
s3:PutObjectAcl	Grants permission to set the access control list (ACL) permission for an object that exists in a bucket.	Permission Management	object*	s3:ExistingObjectTag/<key> s3:authType s3:signatureversion s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class
s3:PutObjectTagging	Grants permission to set the supplied tag-set to an object that exists in a bucket.	Tagging	object*	s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:signatureversion s3:x-amz-content-sha256
s3:PutObjectVersionAcl	Grants permission to use the ACL subresource to set the access control list (ACL) permissions for an object that exists in a bucket.	Permission Management	object*	s3:ExistingObjectTag/<key> s3:authType s3:signatureversion s3:versionid s3:x-amz-acl s3:x-amz-content-sha256 s3:x-amz-grant-full-control s3:x-amz-grant-read s3:x-amz-grant-read-acp s3:x-amz-grant-write s3:x-amz-grant-write-acp s3:x-amz-storage-class
s3:PutObjectVersionTagging	Grants permission to set the supplied tag-set for a specific version of an object.	Tagging	object*	s3:ExistingObjectTag/<key> s3:RequestObjectTag/<key> s3:RequestObjectTagKeys s3:authType s3:signatureversion s3:versionid s3:x-amz-content-sha256
s3:ReplicationInfo	Grants permission to retrieve an object replication status.	Read	object*	-
s3:PutBucketLogging	Grants permission to configure bucket logging on a source bucket.	Permission Management	bucket*	-
s3:GetBucketLogging	Grants permission to retrieve bucket logging on a source bucket.	Permission Management	bucket*	-

Table 9. DCMThe table describes the actions supported for DCM with description, access level, resource type and condition keys.
Action	Description	Access Level	Resource Type (* required)	Condition Keys
dcm:GetWebhookConfiguration	Retrieves a webhook configuration to which notifications can be published.	Read	webhook*	Dependent actions
dcm:CreateWebhookConfiguration	Creates a webhook configuration to which notifications can be published.	Write	webhook*	Dependent actions
dcm:DeleteWebhookConfiguration	Deletes a webhook configuration.	Write	webhook*	Dependent actions
dcm:ListWebhookConfigurations	Retrieves a list of webhook configurations of the requester. Each call returns a limited list of configurations, up to 100.	List	webhook*	Dependent actions