This page is only for existing customers of the S3 Glacier service using Vaults and the original REST API from 2012.
If you're looking for archival storage solutions we suggest using the S3 Glacier storage classes in Amazon S3, S3 Glacier Instant Retrieval, S3 Glacier Flexible Retrieval, and S3 Glacier Deep Archive. To learn more about these storage options, see S3 Glacier storage classes
Identity-based policy examples for Amazon S3 Glacier
By default, users and roles don't have permission to create or modify S3 Glacier resources. They also can't perform tasks by using the Amazon Web Services Management Console, Amazon Command Line Interface (Amazon CLI), or Amazon API. To grant users permission to perform actions on the resources that they need, an IAM administrator can create IAM policies. The administrator can then add the IAM policies to roles, and users can assume the roles.
To learn how to create an IAM identity-based policy by using these example JSON policy documents, see Create IAM policies (console) in the IAM User Guide.
For details about actions and resource types defined by S3 Glacier, including the format of the ARNs for each of the resource types, see Actions, resources, and condition keys for Amazon S3 Glacier in the Service Authorization Reference.
The following is an example policy that grants permissions for three S3 Glacier vault-related actions (glacier:CreateVault
, glacier:DescribeVault
and
glacier:ListVaults
) on a resource, using the Amazon Resource Name
(ARN) that identifies all of the vaults in the us-west-2
Amazon Region.
ARNs uniquely identify Amazon resources. For more information about ARNs used with S3 Glacier,
see Policy resources for S3 Glacier.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glacier:CreateVault", "glacier:DescribeVault", "glacier:ListVaults" ], "Resource": "arn:aws-cn:glacier:us-west-2:123456789012:vaults/*" } ] }
The policy grants permissions to create, list, and obtain descriptions of
vaults in the us-west-2
Region. The wildcard character (*) at the end of
the ARN means that this statement can match any vault name.
Important
When you grant permissions to create a vault using the glacier:CreateVault
operation, you
must specify a wildcard character (*) because you don't know the vault name until after
you create the vault.
Topics
Policy best practices
Identity-based policies determine whether someone can create, access, or delete S3 Glacier resources in your account. These actions can incur costs for your Amazon Web Services account. When you create or edit identity-based policies, follow these guidelines and recommendations:
-
Get started with Amazon managed policies and move toward least-privilege permissions – To get started granting permissions to your users and workloads, use the Amazon managed policies that grant permissions for many common use cases. They are available in your Amazon Web Services account. We recommend that you reduce permissions further by defining Amazon customer managed policies that are specific to your use cases. For more information, see Amazon managed policies or Amazon managed policies for job functions in the IAM User Guide.
-
Apply least-privilege permissions – When you set permissions with IAM policies, grant only the permissions required to perform a task. You do this by defining the actions that can be taken on specific resources under specific conditions, also known as least-privilege permissions. For more information about using IAM to apply permissions, see Policies and permissions in IAM in the IAM User Guide.
-
Use conditions in IAM policies to further restrict access – You can add a condition to your policies to limit access to actions and resources. For example, you can write a policy condition to specify that all requests must be sent using SSL. You can also use conditions to grant access to service actions if they are used through a specific Amazon Web Services service, such as Amazon CloudFormation. For more information, see IAM JSON policy elements: Condition in the IAM User Guide.
-
Use IAM Access Analyzer to validate your IAM policies to ensure secure and functional permissions – IAM Access Analyzer validates new and existing policies so that the policies adhere to the IAM policy language (JSON) and IAM best practices. IAM Access Analyzer provides more than 100 policy checks and actionable recommendations to help you author secure and functional policies. For more information, see Validate policies with IAM Access Analyzer in the IAM User Guide.
-
Require multi-factor authentication (MFA) – If you have a scenario that requires IAM users or a root user in your Amazon Web Services account, turn on MFA for additional security. To require MFA when API operations are called, add MFA conditions to your policies. For more information, see Secure API access with MFA in the IAM User Guide.
For more information about best practices in IAM, see Security best practices in IAM in the IAM User Guide.
Using the S3 Glacier console
To access the Amazon S3 Glacier console, you must have a minimum set of permissions. These permissions must allow you to list and view details about the S3 Glacier resources in your Amazon Web Services account. If you create an identity-based policy that is more restrictive than the minimum required permissions, the console won't function as intended for entities (users or roles) with that policy.
You don't need to allow minimum console permissions for users that are making calls only to the Amazon CLI or the Amazon API. Instead, allow access to only the actions that match the API operation that they're trying to perform.
The S3 Glacier console provides an integrated environment for you to create and manage S3 Glacier vaults. At a minimum IAM identities that you create must be granted permissions for the glacier:ListVaults
action to view the S3 Glacier console as shown in the following example.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "glacier:ListVaults" ], "Effect": "Allow", "Resource": "*" } ] }
Amazon addresses many common use cases by providing standalone IAM policies that are created and administered by Amazon. Managed policies grant necessary permissions for common use cases so you can avoid having to investigate what permissions are needed. For more information, see Amazon Managed Policies in the IAM User Guide.
The following Amazon managed policies, which you can attach to users in your account, are specific to S3 Glacier:
-
AmazonGlacierReadOnlyAccess – Grants read only access to S3 Glacier through the Amazon Web Services Management Console.
-
AmazonGlacierFullAccess – Grants full access to S3 Glacier through the Amazon Web Services Management Console.
You can also create your own custom IAM policies to allow permissions for S3 Glacier API actions and resources. You can attach these custom policies to the custom IAM roles that you create for your S3 Glacier vaults.
Both of the S3 Glacier Amazon Managed policies discussed in the next section grant permissions for glacier:ListVaults
.
For more information, see Adding permissions to a user in the IAM User Guide.
Allow users to view their own permissions
This example shows how you might create a policy that allows IAM users to view the inline and managed policies that are attached to their user identity. This policy includes permissions to complete this action on the console or programmatically using the Amazon CLI or Amazon API.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "ViewOwnUserInfo", "Effect": "Allow", "Action": [ "iam:GetUserPolicy", "iam:ListGroupsForUser", "iam:ListAttachedUserPolicies", "iam:ListUserPolicies", "iam:GetUser" ], "Resource": ["arn:aws-cn:iam::*:user/${aws:username}"] }, { "Sid": "NavigateInConsole", "Effect": "Allow", "Action": [ "iam:GetGroupPolicy", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:ListAttachedGroupPolicies", "iam:ListGroupPolicies", "iam:ListPolicyVersions", "iam:ListPolicies", "iam:ListUsers" ], "Resource": "*" } ] }
Customer Managed Policy Examples
In this section, you can find example user policies that grant permissions for various S3 Glacier actions. These policies work when you are using S3 Glacier REST API, the Amazon SDKs, the Amazon CLI, or, if applicable, the S3 Glacier management console.
Note
All examples use the US West (Oregon) Region (us-west-2
) and contain
fictitious account IDs.
Examples
Example 1: Allow a User to Download Archives from a Vault
To download an archive, you first initiate a job to retrieve the archive. After the
retrieval job is complete, you can download the data. The following example policy
grants permissions for the glacier:InitiateJob
action to initiate a job
(which allows the user to retrieve an archive or a vault inventory from the vault), and
permissions for the glacier:GetJobOutput
action to download the retrieved
data. The policy also grants permissions to perform the glacier:DescribeJob
action
so that the user can get the job status. For more information, see Initiate Job (POST jobs).
The policy grants these permissions on a vault named examplevault
. You can get the
vault ARN from the Amazon S3 Glacier console
{ "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "arn:aws-cn:glacier:us-west-2:123456789012:vaults/examplevault", "Action":["glacier:InitiateJob", "glacier:GetJobOutput", "glacier:DescribeJob"] } ] }
Example 2: Allow a User to Create a Vault and Configure Notifications
The following example policy grants permissions to create a vault in the
us-west-2 Region as specified in the Resource
element and configure
notifications. For more information about working with notifications, see Configuring Vault Notifications in Amazon S3 Glacier. The policy also grants permissions to
list vaults in the Amazon Region and get a specific vault description.
Important
When you grant permissions to create a vault using the
glacier:CreateVault
operation, you must specify a wildcard character (*)
in the Resource
value because you don't know the vault name until after you
create the vault.
{ "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "arn:aws-cn:glacier:us-west-2:123456789012:vaults/*", "Action":["glacier:CreateVault", "glacier:SetVaultNotifications", "glacier:GetVaultNotifications", "glacier:DeleteVaultNotifications", "glacier:DescribeVault", "glacier:ListVaults"] } ] }
Example 3: Allow a User to Upload Archives to a Specific Vault
The following example policy grants permissions to upload archives to a specific vault in the us-west-2 Region. These permissions allow a user to upload an archive all at once using the Upload Archive (POST archive) API operation or in parts using the Initiate Multipart Upload (POST multipart-uploads) API operation.
{ "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "arn:aws-cn:glacier:us-west-2:123456789012:vaults/examplevault", "Action":["glacier:UploadArchive", "glacier:InitiateMultipartUpload", "glacier:UploadMultipartPart", "glacier:ListParts", "glacier:ListMultipartUploads", "glacier:CompleteMultipartUpload"] } ] }
Example 4: Allow a User Full Permissions on a Specific Vault
The following example policy grants permissions for all S3 Glacier actions on a vault named
examplevault
.
{ "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "arn:aws-cn:glacier:us-west-2:123456789012:vaults/examplevault", "Action":["glacier:*"] } ] }