Question

How to set policy of space

Posted May 31, 2018 2.8k views
DigitalOcean API Ubuntu 16.04 Storage

I tried to use s3cmd to set policy of a space. The policy file is like:

{
    "Statement": [
        {
            "Sid": "Allow get requests referred by localhost",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/policy/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": [
                        "http://localhost:8080/*"

                    ]
                }
            }
        }
    ]
}

and then run

s3cmd setpolicy policy s3://my-bucket

The command run without error, but when get the info:

s3cmd info s3://my-bucket

It showed there is no policy on this space:

s3://my-bucket/ (bucket):
   Location:  sgp1
   Payer:     BucketOwner
   Expiration Rule: none
   Policy:    none
  ...

And I still can not access the private file at localhost.

Does space support setpolicy or I done something wrong?

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

4 answers

Here is my bucket policy.json create from AWS S3 and It work with DO Spaces.
Don’t forget to change to your bucketname and your domain.

{
    "Version": "2017-10-17",
    "Id": "http referer policy example",
    "Statement": [
        {
            "Sid": "Allow get requests originating from www.yourdomain.com and subdomain.yourdomain.com.",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::yourbucketname/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": [
                        "https://www.yourdomain.com/*",
                        "https://subdomain.yourdomain.com/*"
                    ]
                }
            }
        }
    ]
}

Try to create policy.json instead policy and run s3cmd setpolicy policy.json s3://my-bucket
If still don’t work recheck the policy.json path is correct.

It’s work for me.

My DO spaces is in nyc3 region.
Also I just try setpolicy with sgp1 region. It’s work. Here is the bucket info.
Notice : It seem sgp1 region have some problem, the connection fail many times. Hope DO staff will check and solve this problem.

s3://mybucketname/ (bucket):
   Location:  sgp1
   Payer:     BucketOwner
   Expiration Rule: none
   Policy:    {
    "Version": "2017-10-17",
    "Id": "http referer policy example",
    "Statement": [
        {
            "Sid": "Allow get requests originating from www.mydomain.com and subdomain.mydomain.com.",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::mybucketname/*",
            "Condition": {
                "StringLike": {
                    "aws:Referer": [
                        "https://www.mydomain.com/*",
                        "https://subdomain.mydomain.com/*"
                    ]
                }
            }
        }
    ]
}
   CORS:      none
   ACL:       xxxxxx: FULL_CONTROL
  • Feels like the problems in sgp1 still exists. I have two droplets in sgp1, and can not
    directly login in one of them and have to login in another droplet and ssh from it to the other.

    • I think you should contact the support team to check your bucket and sgp1 region about this problem. Hope they will fix the problem soon.

Submit an Answer