Amazon Glacier Access Control with Vault Access Policies
The following topics describe Amazon Glacier vault access policies and how to use them.
Vault Access Policy
An Amazon Glacier vault access policy is a resource-based policy that controls access to your vault, which is the resource. You can create one vault access policy for each vault. The vault access policy can be used as a single location to view the list of users with vault access and the allowed actions for each user.
You can assign AWS Identity and Access Management (IAM) policies to IAM users or groups to control the read, write, and delete permissions on your Amazon Glacier vaults. With vault access policies, you can define a single access policy on a vault to govern access to all users. For example, to protect information in a business-critical vault from unintended deletion, you can create a vault access policy that denies delete attempts from all users. You can create and manage vault access policies in the Amazon Glacier console or use the vault access APIs in the AWS SDK.
You can use vault access policies to manage cross-account access. Vault access policies make it easy to grant cross-account access when you need to share your vault with other AWS accounts. For example, you can grant read-only access on a vault to a business partner with a different AWS account by simply including that account and allowed actions in the vault's access policy. You can grant cross-account access to multiple users in this fashion and have a single location to view all users with cross-account access in the vault access policy. For an example of a vault policy for cross-account access, see Granting Permissions to Multiple Accounts.
You can use a vault access policy to grant permissions to perform specific Amazon Glacier API actions. A policy is a document that formally states one or more permissions. For more information about policies, see Overview.
You write a policy using the access policy language and then attach the policy to the vault. For more information about the policy language, see Key Concepts and Using the Access Policy Language.
The following describes some of the policy elements specific to Amazon Glacier:
Resource—This is the Amazon Glacier vault to which you would attach the access policy. You identify a vault resource by using an Amazon Resource Name (ARN) as shown in the following example. The vault ARN specified in the access policy must match the vault resource the policy is attached to.
arn:aws:<vendor>:<region>:<namespace>:<relative-id>In Amazon Glacier,
vendoris the product name "glacier",namespaceis the account ID andrelative-idis always in the format "vaults/<vault-name>".The following is an example ARN for a vault resource
arn:aws:glacier:us-west-2:012345678901:vaults/examplevault.Action—The specific type or types of action allowed or denied. The following are the Amazon Glacier actions allowed for vault access policies.
