ECS 3.6.2 Data Access Guide

Access control

In this section, ECS IAM users and the namespace root users are referred as IAM users.

• Access control for legacy users remains the same.
• Access control for IAM users is similar to AWS IAM user access control in all respects including ACLs.
• Changing the access control for IAM users such as using identity policies, bucket policies, and ACLs do not have any impact on legacy users access control.
• IAM users can access objects and buckets that are created by legacy users if they are provided with the right permissions. By default,
  • Buckets that are created by legacy users have a default ACL associated with the namespace account that contains the bucket. This ACL provides full control over the bucket. This is true for the buckets that are created before or after the upgrade.
  • Objects that are created by legacy users have default ACL associated with the legacy user only.
  • IAM users who have the required permissions can modify ACLs in buckets and objects that are created by legacy users and set an AWS compatible ACL (account ACL or group ACL).
• Legacy users can access objects and buckets that are created by IAM users. For that, legacy user access control should follow legacy semantics. It must also have legacy ACLs associated with them. In detail:
  • The legacy owner for buckets that are created by IAM users is the namespace root user that contains the bucket.
  • The legacy owner for objects that are created by IAM users are respectively the namespace root of the IAM user.
  • Users with appropriate permissions can set or change ACLs anytime.
• A single bucket policy is supported for both IAM and legacy users.
• Management users can attach both IAM and legacy ACLs to buckets from the user interface and using the API.