Skip to content

Commit 31facd6

Browse files
YikaiHuYikaiHu
committed
docs: update the aksk guide and the sse-cmk guide
1 parent 119e8c7 commit 31facd6

File tree

7 files changed

+253
-0
lines changed

7 files changed

+253
-0
lines changed

‎docs/IAM-Policy.md‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
[中文](./IAM-Policy_CN.md)
2+
3+
# Set up Credential for Amazon S3
4+
5+
- ## Step 1: Create IAM Policy
6+
7+
Open AWS Management Console, Go to IAM > Policy, click **Create Policy**
8+
9+
Create a policy using below example IAM policy statement with minimum permissions. Change the `<your-bucket-name>` in the policy statement accordingly.
10+
11+
_Note_: If it's for S3 buckets in China regions, please make sure you also change to use `arn:aws-cn:s3:::` instead of `arn:aws:s3:::`
12+
13+
- ### For Source Bucket
14+
15+
```
16+
{
17+
"Version": "2012-10-17",
18+
"Statement": [
19+
{
20+
"Sid": "dth",
21+
"Effect": "Allow",
22+
"Action": [
23+
"s3:GetObject",
24+
"s3:ListBucket"
25+
],
26+
"Resource":[
27+
"arn:aws:s3:::<your-bucket-name>/*",
28+
"arn:aws:s3:::<your-bucket-name>"
29+
]
30+
}
31+
]
32+
}
33+
```
34+
35+
36+
- ### For Desination Bucket
37+
38+
```
39+
{
40+
"Version": "2012-10-17",
41+
"Statement": [
42+
{
43+
"Sid": "dth",
44+
"Effect": "Allow",
45+
"Action": [
46+
"s3:PutObject",
47+
"s3:GetObject",
48+
"s3:ListBucket",
49+
"s3:PutObjectAcl",
50+
"s3:AbortMultipartUpload",
51+
"s3:ListBucketMultipartUploads",
52+
"s3:ListMultipartUploadParts"
53+
],
54+
"Resource": [
55+
"arn:aws:s3:::<your-bucket-name>/*",
56+
"arn:aws:s3:::<your-bucket-name>"
57+
]
58+
}
59+
]
60+
}
61+
```
62+
63+
> Note that if you want to enable S3 Delete Event, you will need to add `"s3:DeleteObject"` permission to the policy.
64+
65+
> Data Transfer Hub native support the S3 source bucket enabled SSE-S3 and SSE-KMS, but if your source bucket enabled *SSE-CMK*, please replace the source bucket policy with the policy in the link [for S3 SSE-KMS](./S3-SSE-KMS-Policy.md).
66+
67+
- ## Step 2: Create User
68+
69+
Open AWS Management Console, Go to IAM > User, click **Add User**, follow the wizard to create the user with credential.
70+
71+
1. Specify a user name, for example *dth-user*. And for Accesss Type, select **Programmatic access** only. Click **Next: Permissions**
72+
1. Select **Attach existing policies directly**, search and use the policy created in Step 1, and click **Next: Tags**
73+
1. Add tags if needed, click **Next: Review**
74+
1. Review the user details, and Click **Create User**
75+
1. Make sure you copied/saved the credential, and then click **Close**
76+
77+
![Create User](./images/tutortial/IAM-Policy/user.png)

‎docs/IAM-Policy_CN.md‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
[English](./IAM-Policy.md)
2+
3+
# 为 Amazon S3 设置凭证
4+
5+
- ## Step 1: 创建 IAM Policy
6+
7+
打开 AWS 管理控制台，转到 IAM > 策略，单击 **Create Policy**
8+
9+
Create a policy using below example IAM policy statement with minimum permissions. Change the `<your-bucket-name>` in the policy statement accordingly.
10+
11+
使用以下示例 IAM 策略语句以最低权限创建策略。 请相应地更改策略声明中的 `<your-bucket-name>`。
12+
13+
_Note_: 如果是针对中国地区的 S3 存储桶，请确保您更改为使用 `arn:aws-cn:s3::::` 而不是 `arn:aws:s3:::`
14+
15+
- ### 对于源存储桶
16+
17+
```
18+
{
19+
"Version": "2012-10-17",
20+
"Statement": [
21+
{
22+
"Sid": "dth",
23+
"Effect": "Allow",
24+
"Action": [
25+
"s3:GetObject",
26+
"s3:ListBucket"
27+
],
28+
"Resource":[
29+
"arn:aws:s3:::<your-bucket-name>/*",
30+
"arn:aws:s3:::<your-bucket-name>"
31+
]
32+
}
33+
]
34+
}
35+
```
36+
37+
38+
- ### 对于目标存储桶
39+
40+
```
41+
{
42+
"Version": "2012-10-17",
43+
"Statement": [
44+
{
45+
"Sid": "dth",
46+
"Effect": "Allow",
47+
"Action": [
48+
"s3:PutObject",
49+
"s3:GetObject",
50+
"s3:ListBucket",
51+
"s3:PutObjectAcl",
52+
"s3:AbortMultipartUpload",
53+
"s3:ListBucketMultipartUploads",
54+
"s3:ListMultipartUploadParts"
55+
],
56+
"Resource": [
57+
"arn:aws:s3:::<your-bucket-name>/*",
58+
"arn:aws:s3:::<your-bucket-name>"
59+
]
60+
}
61+
]
62+
}
63+
```
64+
65+
> 请注意，如果要启用 S3 删除事件，则需要向策略添加 `"s3:DeleteObject"` 权限。
66+
67+
> Data Transfer Hub 原生支持使用 SSE-S3 和 SSE-KMS 的数据源，但如果您的源存储桶启用了 *SSE-CMK*，请将源存储桶策略替换为链接 [for S3 SSE-CMK](./S3-SSE-KMS-Policy_CN.md)中的策略。
68+
69+
- ## Step 2: 创建 User
70+
71+
打开 AWS 管理控制台，转至 IAM > 用户，单击 **添加用户**，按照向导创建具有凭证的用户。
72+
73+
1. 指定用户名，例如 *dth-user*。 对于 Accesss Type，仅选择 **Programmatic access**。 单击**下一步：权限**
74+
1. 选择**直接附加现有策略**，搜索并使用在步骤 1 中创建的策略，然后单击**下一步：标签**
75+
1. 如果需要，添加标签，单击**下一步：Review**
76+
1. 查看用户详细信息，然后单击**创建用户**
77+
1. 确保您复制/保存了凭据，然后单击**关闭**
78+
79+
![Create User](./images/tutortial/IAM-Policy/user.png)

‎docs/S3-SSE-KMS-Policy.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
[中文](./S3-SSE-KMS-Policy_CN.md)
2+
3+
# Policy for S3 Source Bucket enabled SSE-CMK
4+
5+
Data Transfer Hub native support data source using SSE-S3 and SSE-KMS, if your source bucket enabled *SSE-CMK*, please replace the source bucket policy with the following policy, change the `<your-bucket-name>` in the policy statement accordingly.
6+
7+
And please change the `Resource` in kms part to your own kms key's arn.
8+
9+
_Note_: If it's for S3 buckets in China regions, please make sure you also change to use `arn:aws-cn:s3:::` instead of `arn:aws:s3:::`
10+
11+
- ### For Source Bucket enabled SSE-CMK
12+
13+
```
14+
{
15+
"Version": "2012-10-17",
16+
"Statement": [
17+
{
18+
"Sid": "dth",
19+
"Effect": "Allow",
20+
"Action": [
21+
"s3:GetObject",
22+
"s3:ListBucket"
23+
],
24+
"Resource": [
25+
"arn:aws:s3:::<your-bucket-name>/*",
26+
"arn:aws:s3:::<your-bucket-name>"
27+
]
28+
},
29+
{
30+
"Sid": "VisualEditor0",
31+
"Effect": "Allow",
32+
"Action": [
33+
"kms:Decrypt",
34+
"kms:Encrypt",
35+
"kms:ReEncrypt*",
36+
"kms:GenerateDataKey*",
37+
"kms:DescribeKey"
38+
],
39+
"Resource": [
40+
"arn:aws:kms:us-west-2:123456789012:key/f5cd8cb7-476c-4322-ac9b-0c94a687700d <Please replace to your own KMS key arn>"
41+
]
42+
}
43+
]
44+
}
45+
```

‎docs/S3-SSE-KMS-Policy_CN.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
[English](./S3-SSE-KMS-Policy.md)
2+
3+
# S3 源存储桶启用 SSE-CMK 的策略
4+
5+
Data Transfer Hub 原生支持使用 SSE-S3 和 SSE-KMS 的数据源，但如果您的源存储桶启用了 *SSE-CMK*，请将源存储桶策略替换为以下策略，并更改`<your-bucket-name>` 为相应的桶名称。
6+
7+
并且请将 kms 部分中的 `Resource` 更改为您自己的 KMS 密钥的 arn。
8+
9+
_注意_：如果是针对中国地区的 S3 存储桶，请确保您也更改为使用 `arn:aws-cn:s3:::` 而不是 `arn:aws:s3:::`
10+
11+
- ### 对于启用SSE-CMK的源存储桶
12+
13+
```
14+
{
15+
"Version": "2012-10-17",
16+
"Statement": [
17+
{
18+
"Sid": "dth",
19+
"Effect": "Allow",
20+
"Action": [
21+
"s3:GetObject",
22+
"s3:ListBucket"
23+
],
24+
"Resource": [
25+
"arn:aws:s3:::<your-bucket-name>/*",
26+
"arn:aws:s3:::<your-bucket-name>"
27+
]
28+
},
29+
{
30+
"Sid": "VisualEditor0",
31+
"Effect": "Allow",
32+
"Action": [
33+
"kms:Decrypt",
34+
"kms:Encrypt",
35+
"kms:ReEncrypt*",
36+
"kms:GenerateDataKey*",
37+
"kms:DescribeKey"
38+
],
39+
"Resource": [
40+
"arn:aws:kms:us-west-2:123456789012:key/f5cd8cb7-476c-4322-ac9b-0c94a687700d <Please replace to your own KMS key arn>"
41+
]
42+
}
43+
]
44+
}
45+
```

‎docs/UserManual.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ S3 Replication Task supports the following sources:
2626

2727
The S3 Plugin uses credentials to replicate data from Amazon S3 in another partition or other cloud providers. Store your credentials in [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html).
2828

29+
30+
### Create Credentials
31+
Please refer to the [DTH S3 Credential Setup Guide](./IAM-Policy.md).
32+
2933
### Configure Credentials
3034

3135
1. Open **[Secrets Manager](https://console.aws.amazon.com/secretsmanager/home#)** console

‎docs/UserManual_CN.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ S3复制任务支持以下数据源：
2525

2626
S3插件使用凭证从AWS另一个区的Amazon S3或其他云提供商中复制数据。 您的凭据将存储在 [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html).
2727

28+
### 创建凭证
29+
请参考 [DTH S3 凭证设置教程](./IAM-Policy_CN.md).
30+
2831
### 配置凭证
2932

3033
1. 打开 **[Secrets Manager](https://console.aws.amazon.com/secretsmanager/home#)** 控制台

‎docs/images/tutortial/IAM-Policy/user.png‎

71 KB
Loading

0 commit comments

Comments
 (0)