Policy Management

Overview

MinIO uses Policy-Based Access Control (PBAC) to define the authorized actions and resources to which an authenticated user has access. Each policy describes one or more actions and conditions that outline the permissions of a user or group of users.

MinIO PBAC is built for compatibility with AWS IAM policy syntax, structure, and behavior. The MinIO documentation makes a best-effort to cover IAM-specific behavior and functionality. Consider deferring to the IAM documentation for more complete documentation on AWS IAM-specific topics.

The mc admin policy command supports creation and management of policies on the MinIO deployment. See the command reference for examples of usage.

Built-In Policies

MinIO provides the following built-in policies for assigning to users or groups:

consoleAdmin

Grants complete access to all S3 and administrative API operations against all resources on the MinIO deployment. Equivalent to the following set of actions:

• s3:*

• admin:*

readonly

Grants read-only permissions on any object on the MinIO deployment. The GET action must apply to a specific object without requiring any listing. Equivalent to the following set of actions:

• s3:GetBucketLocation

• s3:GetObject

For example, this policy specifically supports GET operations on objects at a specific path (e.g. GET play/mybucket/object.file), such as:

• mc cp

• mc stat

• mc head

• mc cat

The exclusion of listing permissions is intentional, as typical use cases do not intend for a “read-only” role to have complete discoverability (listing all buckets and objects) on the object storage resource.

readwrite

Grants read and write permissions for all buckets and objects on the MinIO server. Equivalent to s3:*.

diagnostics

Grants permission to perform diagnostic actions on the MinIO deployment. Specifically includes the following actions:

• admin:ServerTrace

• admin:Profiling

• admin:ConsoleLog

• admin:ServerInfo

• admin:TopLocksInfo

• admin:OBDInfo

• admin:BandwidthMonitor

• admin:Prometheus

writeonly

Grants write-only permissions to any namespace (bucket and path to object) the MinIO deployment. The PUT action must apply to a specific object location without requiring any listing. Equivalent to the s3:PutObject action.

Use mc admin policy set to associate a policy to a user or group on a MinIO deployment.

For example, consider the following table of users. Each user is assigned a built-in policy or a supported action. The table describes a subset of operations a client could perform if authenticated as that user:

Each user can access only those resources and operations which are explicitly granted by the built-in role. MinIO denies access to any other resource or action by default.

Policy Document Structure

MinIO policy documents use the same schema as AWS IAM Policy documents.

The following sample document provides a template for creating custom policies for use with a MinIO deployment. For more complete documentation on IAM policy elements, see the IAM JSON Policy Elements Reference.

{
   "Version" : "2012-10-17",
   "Statement" : [
      {
         "Effect" : "Allow",
         "Action" : [ "s3:<ActionName>", ... ],
         "Resource" : "arn:aws:s3:::*",
         "Condition" : { ... }
      },
      {
         "Effect" : "Deny",
         "Action" : [ "s3:<ActionName>", ... ],
         "Resource" : "arn:aws:s3:::*",
         "Condition" : { ... }
      }
   ]
}

• For the Statement.Action array, specify one or more supported S3 API operations. MinIO deployments supports a subset of AWS S3 API operations.

• For the Statement.Resource key, you can replace the * with the specific bucket to which the policy statement should apply. Using * applies the statement to all resources on the MinIO deployment.

• For the Statement.Condition key, you can specify one or more supported Conditions. MinIO deployments supports a subset of AWS S3 conditions.

Supported S3 Policy Actions

MinIO policy documents support a subset of IAM S3 Action keys.

The following actions control access to common S3 operations. The remaining subsections document actions for more advanced S3 operations:

s3:*

Selector for all MinIO S3 operations. Applying this action to a given resource allows the user to perform any S3 operation against that resource.

s3:CreateBucket

Controls access to the CreateBucket S3 API operation.

s3:DeleteBucket

Controls access to the DeleteBucket S3 API operation.

s3:ForceDeleteBucket

Controls access to the DeleteBucket S3 API operation for operations with the x-minio-force-delete flag. Required for removing non-empty buckets.

s3:GetBucketLocation

Controls access to the GetBucketLocation S3 API operation.

s3:ListAllMyBuckets

Controls access to the ListBuckets S3 API operation.

s3:DeleteObject

Controls access to the DeleteObject S3 API operation.

s3:GetObject

Controls access to the GetObject S3 API operation.

s3:ListBucket

Controls access to the ListObjectsV2 S3 API operation.

s3:PutObject

Controls access to the PutObject S3 API operation.

s3:PutObjectTagging

Controls access to the PutObjectTagging S3 API operation.

s3:GetObjectTagging

Controls access to the GetObjectTagging S3 API operation.

Supported S3 Policy Condition Keys

MinIO policy documents support IAM conditional statements.

Each condition element consists of operators and condition keys. MinIO supports a subset of IAM condition keys. For complete information on any listed condition key, see the IAM Condition Element Documentation

MinIO supports the following condition keys for all supported actions:

• aws:Referer

• aws:SourceIp

• aws:UserAgent

• aws:SecureTransport

• aws:CurrentTime

• aws:EpochTime

• aws:PrincipalType

• aws:userid

• aws:username

• x-amz-content-sha256

The following table lists additional supported condition keys for specific actions:

mc admin Policy Action Keys

MinIO supports the following actions for use with defining policies for mc admin operations. These actions are only valid for MinIO deployments and are not intended for use with other S3-compatible services:

admin:*

Selector for all admin action keys.

admin:Heal

Allows heal command

admin:StorageInfo

Allows listing server info

admin:DataUsageInfo

Allows listing data usage info

admin:TopLocksInfo

Allows listing top locks

admin:Profiling

Allows profiling

admin:ServerTrace

Allows listing server trace

admin:ConsoleLog

Allows listing console logs on terminal

admin:KMSCreateKey

Allows creating a new KMS master key

admin:KMSKeyStatus

Allows getting KMS key status

admin:ServerInfo

Allows listing server info

admin:OBDInfo

Allows obtaining cluster on-board diagnostics

admin:ServerUpdate

Allows MinIO binary update

admin:ServiceRestart

Allows restart of MinIO service.

admin:ServiceStop

Allows stopping MinIO service.

admin:ConfigUpdate

Allows MinIO config management

admin:CreateUser

Allows creating MinIO user

admin:DeleteUser

Allows deleting MinIO user

admin:ListUsers

Allows list users permission

admin:EnableUser

Allows enable user permission

admin:DisableUser

Allows disable user permission

admin:GetUser

Allows GET permission on user info

admin:AddUserToGroup

Allows adding user to group permission

admin:RemoveUserFromGroup

Allows removing user to group permission

admin:GetGroup

Allows getting group info

admin:ListGroups

Allows list groups permission

admin:EnableGroup

Allows enable group permission

admin:DisableGroup

Allows disable group permission

admin:CreatePolicy

Allows create policy permission

admin:DeletePolicy

Allows delete policy permission

admin:GetPolicy

Allows get policy permission

admin:AttachUserOrGroupPolicy

Allows attaching a policy to a user/group

admin:ListUserPolicies

Allows listing user policies

admin:CreateServiceAccount

Allows creating MinIO Service Account

admin:UpdateServiceAccount

Allows updating MinIO Service Account

admin:RemoveServiceAccount

Allows deleting MinIO Service Account

admin:ListServiceAccounts

Allows listing MinIO Service Account

admin:SetBucketQuota

Allows setting bucket quota

admin:GetBucketQuota

Allows getting bucket quota

admin:SetBucketTarget

Allows setting bucket target

admin:GetBucketTarget

Allows getting bucket targets

admin:SetTier

Allows creating and modifying remote storage tiers using the mc admin tier command.

admin:ListTier

Allows listing configured remote storage tiers using the mc admin tier command.

admin:BandwidthMonitor

Allows retrieving metrics related to current bandwidth consumption.

admin:Prometheus

Allows access to MinIO metrics. Only required if MinIO requires authentication for scraping metrics.

mc admin Policy Condition Keys

MinIO supports the following conditions for use with defining policies for mc admin actions.

• aws:Referer

• aws:SourceIp

• aws:UserAgent

• aws:SecureTransport

• aws:CurrentTime

• aws:EpochTime

For complete information on any listed condition key, see the IAM Condition Element Documentation