Policies, groups and temporary credentials

Bucket policies on every path, public access blocked by default, CORS and browser form uploads, groups of users, and temporary keys narrowed by a session policy.

Access starts from per-bucket grants to users (see Security). Four things widen or narrow it.

Bucket policies

PutBucketPolicy stores an IAM-style policy. It is evaluated on every request, the console's included:

an explicit Deny outweighs every grant;
a request without credentials reaches only what a policy grants everyone;
a statement this server cannot evaluate as written is refused MalformedPolicy.

Block Public Access

Every bucket that set nothing has every switch on: a public policy is refused, and a public policy's Allows reach only the bucket's own space. DeletePublicAccessBlock turns the block off. ACLs are never honoured.

CORS and browser uploads

PutBucketCors takes up to 100 rules. A browser's OPTIONS preflight is answered without credentials by the first rule matching its origin, method and headers.

A browser form can POST /{bucket} a file. Its signed policy (expiration, eq, starts-with, content-length-range) must cover every field; the upload is then authorized as the signer's PutObject. A form without a policy is anonymous.

Groups

A group is a named set of users of one space. A bucket granted to a group reaches every member; removing a member or the grant ends it within the 5-second resolution window. Members and granted buckets must belong to the group's space. Space admins and operators manage groups in the console (Groups).

Temporary credentials

A person the console's identity provider vouches for can ask for temporary keys:

POST /
Action=AssumeRoleWithWebIdentity
RoleArn=arn:aws:iam::<space>:role/<user>
RoleSessionName=…
WebIdentityToken=<ID token>
DurationSeconds=900…43200

The token must come from the configured provider and name a second factor in amr; the role names the user that identity is linked to. The answer carries an access key, a secret and a session token, valid 15 minutes to 12 hours (default 1 hour).

Every request signs with the session token as x-amz-security-token. The keys end at expiry, when the identity is unlinked, when the user is disabled, or at a provider logout.

An optional Policy (at most 2 048 characters, S3 resources only) narrows them: a request needs the user's own access and the policy's Allow, and the policy's Deny refuses. It never grants more than the user has.

Requests are limited per client address by TESSARIDB_S3_CONSOLE_SIGN_INS_PER_MINUTE.