Access Control for Snow Family Console and Creating Jobs - Amazon Snowball Edge Developer Guide
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

Access Control for Snow Family Console and Creating Jobs

As with all Amazon services, access to Amazon Snowball requires credentials that Amazon can use to authenticate your requests. Those credentials must have permissions to access Amazon resources, such an Amazon S3 bucket or an Amazon Lambda function. Amazon Snowball differs in two ways:

  1. Jobs in Amazon Snowball do not have Amazon Resource Names (ARNs).

  2. Physical and network access control for a device on-premises is your responsibility.

The following sections provide details on how you can use Amazon Identity and Access Management (IAM) and Amazon Snowball to help secure your resources by controlling who can access them in the Amazon Web Services Cloud, and also local access control recommendations.

Authentication

You can access Amazon as any of the following types of identities:

  • Amazon Web Services account root user

    When you create an Amazon Web Services account, you begin with one sign-in identity that has complete access to all Amazon Web Services and resources in the account. This identity is called the Amazon Web Services account root user and is accessed by signing in with the email address and password that you used to create the account. We strongly recommend that you do not use the root user for your everyday tasks. Safeguard your root user credentials and use them to perform the tasks that only the root user can perform. For the complete list of tasks that require you to sign in as the root user, see Tasks that require root user credentials in the Amazon General Reference.

  • IAM users and groups

    An IAM user is an identity within your Amazon Web Services account that has specific permissions for a single person or application. Where possible, we recommend relying on temporary credentials instead of creating IAM users who have long-term credentials such as passwords and access keys. However, if you have specific use cases that require long-term credentials with IAM users, we recommend that you rotate access keys. For more information, see Rotate access keys regularly for use cases that require long-term credentials in the IAM User Guide.

    An IAM group is an identity that specifies a collection of IAM users. You can't sign in as a group. You can use groups to specify permissions for multiple users at a time. Groups make permissions easier to manage for large sets of users. For example, you could have a group named IAMAdmins and give that group permissions to administer IAM resources.

    Users are different from roles. A user is uniquely associated with one person or application, but a role is intended to be assumable by anyone who needs it. Users have permanent long-term credentials, but roles provide temporary credentials. To learn more, see When to create an IAM user (instead of a role) in the IAM User Guide.

  • IAM role

    An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar to an IAM user in that it is an Amazon identity with permissions policies that determine what the identity can and cannot do in Amazon. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session. IAM roles with temporary credentials are useful in the following situations:

    • Federated user access – To assign permissions to a federated identity, you create a role and define permissions for the role. When a federated identity authenticates, the identity is associated with the role and is granted the permissions that are defined by the role. For information about roles for federation, see Creating a role for a third-party Identity Provider in the IAM User Guide.

    • Amazon Web Service access – A service role is an IAM role that a service assumes to perform actions on your behalf. An IAM administrator can create, modify, and delete a service role from within IAM. For more information, see Creating a role to delegate permissions to an Amazon Web Service in the IAM User Guide.

    • Applications running on Amazon EC2 – You can use an IAM role to manage temporary credentials for applications that are running on an EC2 instance and making Amazon CLI or Amazon API requests. This is preferable to storing access keys within the EC2 instance. To assign an Amazon role to an EC2 instance and make it available to all of its applications, you create an instance profile that is attached to the instance. An instance profile contains the role and enables programs that are running on the EC2 instance to get temporary credentials. For more information, see Using an IAM role to grant permissions to applications running on Amazon EC2 instances in the IAM User Guide.

Overview of Managing Access Permissions to Your Resources in the Amazon Web Services Cloud

Every Amazon resource is owned by an Amazon Web Services account, and permissions to create or access a resource are governed by permissions policies. An account administrator can attach permissions policies to IAM identities (that is, users, groups, and roles), and some services (such as Amazon Lambda) also support attaching permissions policies to resources.

Note

An account administrator (or administrator user) is a user with administrator privileges. For more information, see IAM Best Practices in the IAM User Guide.

When granting permissions, you decide who is getting the permissions, the resources they get permissions for, and the specific actions that you want to allow on those resources.

Resources and Operations

In Amazon Snowball, the primary resource is a job. Amazon Snowball also has devices like the Snowball and the Amazon Snowball Edge device, however, you can only use those devices in the context of an existing job. Amazon S3 buckets and Lambda functions are resources of Amazon S3 and Lambda respectively.

As mentioned previously, jobs don't have Amazon Resource Names (ARNs) associated with them. However, other services' resources, like Amazon S3 buckets, do have unique (ARNs) associated with them as shown in the following table.

Resource Type ARN Format
S3 bucket arn:aws:s3:region:account-id:BucketName/ObjectName

Amazon Snowball provides a set of operations to create and manage jobs. For a list of available operations, see the Amazon Snowball API Reference.

Understanding Resource Ownership

The Amazon Web Services account owns the resources that are created in the account, regardless of who created the resources. Specifically, the resource owner is the Amazon Web Services account of the principal entity (that is, the root account, an IAM user, or an IAM role) that authenticates the resource creation request. The following examples illustrate how this works:

  • If you use the root account credentials of your Amazon Web Services account to create a S3 bucket, your Amazon Web Services account is the owner of the resource (in Amazon Snowball, the resource is the job).

  • If you create an IAM user in your Amazon Web Services account and grant permissions to create a job to that user, the user can create a job. However, your Amazon Web Services account, to which the user belongs, owns the job resource.

  • If you create an IAM role in your Amazon Web Services account with permissions to create a job, anyone who can assume the role can create a job. Your Amazon Web Services account, to which the role belongs, owns the job resource.

Managing Access to Resources in the Amazon Web Services Cloud

A permissions policy describes who has access to what. The following section explains the available options for creating permissions policies.

Note

This section discusses using IAM in the context of Amazon Snowball. It doesn't provide detailed information about the IAM service. For complete IAM documentation, see What Is IAM? in the IAM User Guide. For information about IAM policy syntax and descriptions, see Amazon IAM Policy Reference in the IAM User Guide.

Policies attached to an IAM identity are referred to as identity-based policies (IAM polices) and policies attached to a resource are referred to as resource-based policies. Amazon Snowball supports only identity-based policies (IAM policies).

Identity-Based Policies (IAM Policies)

You can attach policies to IAM identities. For example, you can do the following:

  • Attach a permissions policy to a user or a group in your account – To grant a user permissions to create a job, you can attach a permissions policy to a user or group that the user belongs to.

  • Attach a permissions policy to a role (grant cross-account permissions) – You can attach an identity-based permissions policy to an IAM role to grant cross-account permissions. For example, the administrator in Account A can create a role to grant cross-account permissions to another Amazon Web Services account (for example, Account B) or an Amazon service as follows:

    1. Account A administrator creates an IAM role and attaches a permissions policy to the role that grants permissions on resources in Account A.

    2. Account A administrator attaches a trust policy to the role identifying Account B as the principal who can assume the role.

    3. Account B administrator can then delegate permissions to assume the role to any users in Account B. Doing this allows users in Account B to create or access resources in Account A. The principal in the trust policy can also be an Amazon service principal if you want to grant an Amazon service permissions to assume the role.

    For more information about using IAM to delegate permissions, see Access Management in the IAM User Guide.

The following is an example policy that allows a user to perform the CreateJob action for your Amazon Web Services account.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "snowball:DescribeAddress", "snowball:CreateJob", "snowball:DescribeAddresses", "snowball:CreateAddress" ], "Resource": "*" }, ] }

For more information about using identity-based policies with Amazon Snowball, see Using Identity-Based Policies (IAM Policies) for Amazon Snowball. For more information about users, groups, roles, and permissions, see Identities (Users, Groups, and Roles) in the IAM User Guide.

Resource-Based Policies

Other services, such as Amazon S3, also support resource-based permissions policies. For example, you can attach a policy to an S3 bucket to manage access permissions to that bucket. Amazon Snowball doesn't support resource-based policies. 

Specifying Policy Elements: Actions, Effects, and Principals

For each job (see Resources and Operations), the service defines a set of API operations (see Amazon Snowball API Reference) to create and manage said job. To grant permissions for these API operations, Amazon Snowball defines a set of actions that you can specify in a policy. For example, for a job, the following actions are defined: CreateJob, CancelJob, and DescribeJob. Note that, performing an API operation can require permissions for more than one action.

The following are the most basic policy elements:

  • Resource – In a policy, you use an Amazon Resource Name (ARN) to identify the resource to which the policy applies. For more information, see Resources and Operations.

    Note

    This is supported for Amazon S3, Amazon EC2, Amazon Lambda, Amazon KMS, and many other services.

    Snowball does not support specifying a resource ARN in the Resource element of an IAM policy statement. To allow access to Snowball, specify “Resource”: “*” in your policy.

  • Action – You use action keywords to identify resource operations that you want to allow or deny. For example, depending on the specified Effect, snowball:* either allows or denies the user permissions to perform all operations.

    Note

    This is supported for Amazon EC2, Amazon S3, and IAM.

  • Effect – You specify the effect when the user requests the specific action—this can be either allow or deny. If you don't explicitly grant access to (allow) a resource, access is implicitly denied. You can also explicitly deny access to a resource, which you might do to make sure that a user cannot access it, even if a different policy grants access.

    Note

    This is supported for Amazon EC2, Amazon S3, and IAM.

  • Principal – In identity-based policies (IAM policies), the user that the policy is attached to is the implicit principal. For resource-based policies, you specify the user, account, service, or other entity that you want to receive permissions (applies to resource-based policies only). Amazon Snowball doesn't support resource-based policies.

To learn more about IAM policy syntax and descriptions, see Amazon IAM Policy Reference in the IAM User Guide.

For a table showing all of the Amazon Snowball API actions, see Amazon Snowball API Permissions: Actions, Resources, and Conditions Reference.

Specifying Conditions in a Policy

When you grant permissions, you can use the IAM policy language to specify the conditions when a policy should take effect. For example, you might want a policy to be applied only after a specific date. For more information about specifying conditions in a policy language, see Condition in the IAM User Guide.

To express conditions, you use predefined condition keys. There are no condition keys specific to Amazon Snowball. However, there are Amazon-wide condition keys that you can use as appropriate. For a complete list of Amazon-wide keys, see Available Keys for Conditions in the IAM User Guide.