I have a minio s3 instance and a client python script that uploads/downloads and lists objects using boto3. I have users user1 and user2 with admin rights to respective private buckets bucket1 and bucket2. Now user1 wants to share a file in bucket1 with user2. The first thing that comes to mind is to update the bucket policy for bucket1 to allow user2 to 'list' and 'get' the file (image.png) So user1 puts the following policy into bucket1 policy: { "Version": "2012-10-17", "Statement": [ { "Sid": "allow_list_user2", "Effect": "Allow", "Principal": { "AWS": [ "minio:user:user2" ] }, "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::bucket1" ], "Condition": { "StringLike": { "s3refix": [ "image.png" ] } } }, { "Sid": "allow_get_user2", "Effect": "Allow", "Principal": { "AWS": [ "minio:user:user2" ] }, "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::bucket1/image.png" ] } ]} Now user2 has the permissions to list and get the object even though it is in bucket1. My question is: how do I as user2 list all files from bucket1 that I have access to if I don't have a database to keep track of what was shared with me. I am using boto3's list_objects_v2() to list the files I have access to. If I call list_objects_v2(bucket, prefix) as user2 on bucket1 I have to specify the exact prefix or file name to match the regex in the policy, otherwise I get 'Access Denied'. I realize this is not exactly production-grade approach in any way for various reasons (concurrency issues, hard to recover once something goes wrong, policy length limitations etc.) Note: I want to keep the permission granularity and have individual permissions for each file. So I discarded the idea of moving all of the files shared with user2 to a directory bucket1/shared_with_user2 as I will need to come up with directories for every possible combination of users I share files with. And I don't want user2 to be able to list files from bucket1 that are not shared with them. Continue reading...
