Dell ObjectScale 1.3 Administration Guide

The IAM Logging Principal is used to grant permission to write request-logs in the target bucket.

• The required principal is "logging.s3.objscale.dell.com".
• The principal must be given S3:PutObject permission.
• The principal is added to the bucket policy on the target bucket.

The following example adds the logging principal to a target bucket with a bucket policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AccessLogsPolicy",
            "Effect": "Allow",
            "Principal": {
                "Service": "logging.s3.objscale.dell.com"
            },
            "Action": [
                "s3:PutObject"
            ],
            "Resource": ["arn:aws:s3:osci4e7b81b1fedc9e6e:ostibc6ebb467b46f882:targetbucket/*"],
 
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": ["osai3483c631fef0da7a"]
                },
 
                "ForAnyValue:ArnLike": {
                    "aws:SourceArn": ["arn:aws:s3:osci4e7b81b1fedc9e6e:ostibc6ebb467b46f882:sourcebucket*"]
                }
           }
        }
    ]
}
 
        

The Statement specifies the following elements:

Resource

The resource contains the target bucket ARN which includes the ObjectScale ID, the Object store ID, and the name of the target bucket. This is followed by a wildcard for the kinds of objects the logging principal is allowed to create. If a prefix is added, then the logs would be restricted to sources with the designated prefix. For example, "Resource": [arn:aws:s3:osci4e7b81b1fedc9e6e:ostibc6ebb467b46f882:targetbucket/Billing/*] allows source buckets to log to the targetbucket, only if the source bucket is assigned a prefix Billing/ to its bucket logging configuration.

Condition

The condition allows further restrictions on what source buckets are allowed to send request logs to the target bucket. If a Condition is not set, any source bucket from any account in the same Object store is allowed to log requests on the target bucket.

NOTE:Bucket logging supports bucket policies that grant or restrict access to the target bucket by aws:SourceAccount and awsSourceArn.

If a SourceAccount condition is set, only buckets owned by accounts listed are permitted to log requests to the target bucket.

If a SourceArn condition is set, only source buckets matching the condition are permitted to log requests to the target bucket.

SourceAccount and SourceArn conditions are not dependent on each other. A combination of one or the other or both can be used to restrict access to the target bucket.