Dell ObjectScale 1.3 Administration Guide

PDF

Required IAM permissions

The IAM role used to perform the object replication must have permissions to replicate objects from the source bucket to the destination bucket. It must be a service role which allows the s3 service to assume it. The role applies to the source account.

To set or change the IAM role that is associated with a replication, use the Bucket Replication Rule Editor in the ObjectScale Portal user interface. The IAM role field is in the Destination section of the editor. The editor presents a dropdown list of existing roles in the source account. For more information, see the steps about the Destination tab in Configure a new bucket replication rule or Edit an existing bucket replication rule.

If you are creating a new IAM role for replication, the following table shows all required permissions that the IAM role must possess.

Table 1. Required permissions in the source account IAM role for replication
Action	Required allow permissions	Target
Configure replication policy and rules.	s3:ReplicateObject	On the destination bucket
	s3:GetBucketVersioning
	s3:ListBucketVersions
	s3: ReplicateTags
	s3:PutObjectRetention
	s3:PutObjectLegalHold
	s3:BypassGovernanceRetention
Replicate a delete marker.	s3:ReplicateDelete	On the destination bucket
Change the object owner.	s3: ObjectOwnerOverrideToBucketOwner	On the destination bucket
Access a source bucket.	s3:GetObjectVersionForReplication	On the source bucket
	s3:GetObjectVersionAcl
	s3:GetObjectVersionTagging
	s3:GetObjectRetention
	s3:GetObjectLegalHold