How to Create Subaccounts and Share Buckets Using IAM and CloudBerry S3 Explorer

As always we are trying to stay on top of the new functionality offered by Amazon S3  to offer the most compelling Amazon S3 and CloudFront client on Windows platform.

A few weeks ago Amazon introduced Identity and Access Management (IAM) Service. It is a new exciting service that allows creating user accounts inside the master account and grants those account a set of permissions. CloudBerry Explorer PRO 2.4 already comes with full support for IAM service and you can learn more about that in our previous blog post.
In this blog post, we will look into the very common scenario of creating a subaccount within the master account and granting it permissions to a creation bucket.  This might be useful if you, for instance, work with freelancers and want them to be able to work with the content in their own bucket.

Creating a policy

Click Access Manager in the main menu to run IAM management tool from within CloudBerry Explorer.
How to create S3 Bucket Share-1
In the Access Manager click New User to open up a dialog. Name the user and click ok.
How to create S3 Bucket Share-2
The new user should show up on the list. Right click it and click Add Policy…
Specifying IAM Share Bucket-3

Click New Statement and then

to choose the list of actions that your new users will be allowed to do. You can see below those the most common ones.

Click in: to specify the bucket name and the path. Make sure to add “/*” to the path to propagate the policy to the bucket content.
Click New Statement once again this time for the bucket itself. Choose S3: ListBucket for action and make sure that you don’t add “/*” at the end. This is because you are applying the statement to a bucket, not to its contents.
You can optionally set a condition.  In our example, it is valid only till Nov 1 2010. After that time the user will not have access to the resource.
Click Ok to create the policy.
Specifying IAM Share Bucket-4
Here is the policy text cause you want to copy it:
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:GetObjectAcl",
"s3:PutObjectAcl",
"s3:DeleteObject"
],
"Resource": "arn:aws:s3:::cloudberry.public/*",
"Condition": {}
},
{
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetBucketLocation",
"s3:GetBucketAcl"
],
"Resource": "arn:aws:s3:::cloudberry.public",
"Condition": {}
}
]
}
Last but not least, you have to generate an access/ secret key pair for your new user.  Click Generate Access Keys… in the user context menu.  Copy the keys so that you can hand them over to the user later.
Specifying IAM Share Bucket-5

Working as a User

Register an account for the newly created user in CloudBerry Explorer console.  Use assess/ secret key created earlier.
Note: you can use CloudBerry Explorer freeware to register one bucket for IAM user. If you need to register more than one bucket you will have to turn to our pro version.
Specifying IAM Share Bucket-6
Now, select the newly created account in the drop-down list. If you look at the list of buckets it will be empty. This is because we have not granted the user a right to list all buckets. You have to add a bucket as an external bucket manually. Click a green button on the toolbar and type the bucket name manually.
How to create S3 Bucket Share-7
Now you can see the bucket in the console. You can copy, move, delete files, create folders, etc.
How to create S3 Bucket Share-8
As always we would be happy to hear your feedback and you are welcome to post a comment.
Note: this post applies to CloudBerry Explorer 2.4.2 and later.