mc admin policy

Description

The mc admin policy command manages policies for use with MinIO Policy-Based Access Control (PBAC). MinIO PBAC uses IAM-compatible policy JSON documents to define rules for accessing resources on a MinIO server.

For complete documentation on MinIO PBAC, including policy document JSON structure and syntax, see Access Management.

Examples

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
            "s3:ListAllMyBuckets"
         ],
         "Resource": [
            "arn:aws:s3:::*"
         ]
      }
   ]
}

mc admin policy add myminio listbucketsonly /path/to/listbucketsonly.json

mc admin policy list myminio

readwrite
writeonly

mc admin policy info myminio writeonly

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
            "s3:PutObject"
         ],
         "Resource": [
            "arn:aws:s3:::*"
         ]
      }
   ]
}

mc admin policy remove myminio listbucketsonly

mc admin policy set myminio listbucketsonly user=<USER>

mc admin policy set myminio listbucketsonly group=<GROUP>

Syntax

mc admin policy add

Creates a new policy on the target MinIO deployment. The command has the following syntax:

mc admin policy add TARGET POLICYNAME POLICYPATH

The mc admin policy add command accepts the following arguments:

TARGET

The alias of a configured MinIO deployment on which to add the new policy.

POLICYNAME

The name of the policy to add.

Specifying the name of an existing policy overwrites that policy on the TARGET MinIO deployment.

POLICYPATH

The file path to the policy to add. The file must be a JSON-formatted file with IAM-compatible syntax.

mc admin policy list

Lists all policies on the target MinIO deployment. The command has the following syntax:

mc admin policy list TARGET

For example, the following command lists all policies on the myminio MinIO deployment:

mc admin policy list play

The mc admin policy list command accepts the following arguments:

TARGET

The alias of a configured MinIO deployment from which the command lists the available policies.

mc admin policy info

Returns the specified policy in JSON format if it exists on the target MinIO deployment. The command has the following syntax:

mc admin policy info TARGET POLICYNAME

mc admin policy info accepts the following arguments:

TARGET

The alias of a configured MinIO deployment from which the command returns information on the specified policy.

POLICYNAME

The name of the policy whose details the command returns.

mc admin policy set

Applies an existing policy to a user or group on the target MinIO deployment. mc admin policy set overwrites the existing policy associated to the user or group.

The command has the following syntax:

mc admin policy set TARGET POLICYNAME[,POLICYNAME,...] [ user=USERNAME | group=GROUPNAME ]

The command accepts the following arguments:

TARGET

The alias of a configured MinIO deployment on which the command associates the POLICYNAME to the user or group.

POLICYNAME

The name of the policy which the command associates to the specified user or group. Specify multiple policies as a comma-separated list.

MinIO deployments include the following built-in policies policies by default:

• readonly

• readwrite

• diagnostics

• writeonly

user

The name of the user to which the command associates the POLICYNAME.

Mutually exclusive with group

group

The name of the group to which the command associates the POLICYNAME. All users with membership in the group inherit the policies associated to the group.

Mutually exclusive with user

mc admin policy remove

This command removes an existing policy from the target MinIO deployment. The command has the following syntax:

mc admin policy remove TARGET POLICYNAME

The command accepts the following arguments:

TARGET

The alias of a configured MinIO deployment on which the command removes the POLICYNAME.

POLICYNAME

The name of the policy which the command removes from the TARGET deployment.