I have a webapp that requires uploading/deleting/reading files inside a S3 bucket.
What I did was I created a brand new Amazon WebServices (aka AWS) account. Let's call this AWS account
I created a S3 bucket
webapp-cdn when logged in as
I know I need a key and secret so that my webapp can have read-write access to the bucket.
firstname.lastname@example.org AWS account has a security credentials page which shows me this IAM system.
I created a User called
webapp_system inside the IAM and a Group called
s3_all_access. I put the
webapp_system User inside the Group
s3_all_access and granted ALL access to ALL buckets for members of this Group.
There is no way to select only specific buckets for access when I created the Group.
Now the User has its own key and secret. I can also generate a root credentials for the account
email@example.com consisting of key and secret.
My question is which access keys should I use? I am confused by this IAM which I have never used before. At the same time, I appreciate having more granular User Authorization controls.
I have the following buckets setup in the same S3 account.
webapp-cdn: this is for LIVE server
webapp-stage: this is for Staging server
webapp-devt: this is for testing during development
I have tried exploring Role in IAM. It appears to be unsuitable.
I am not sure what is best. Ideally I prefer to have 1 unique pair of access key for each bucket. This is to reduce chances of developers leaking keys to the bucket responsible for the LIVE server.
I have read the FAQ but it confused me further than enlightened me.