Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a webapp that requires uploading/deleting/reading files inside a S3 bucket.

What I did was I created a brand new Amazon WebServices (aka AWS) account. Let's call this AWS account team@webapp.com

I created a S3 bucket webapp-cdn when logged in as team@webapp.com

I know I need a key and secret so that my webapp can have read-write access to the bucket.

The team@webapp.com AWS account has a security credentials page which shows me this IAM system.

I created a User called webapp_system inside the IAM and a Group called s3_all_access. I put the webapp_system User inside the Group s3_all_access and granted ALL access to ALL buckets for members of this Group.

There is no way to select only specific buckets for access when I created the Group.

Now the User has its own key and secret. I can also generate a root credentials for the account team@webapp.com consisting of key and secret.

My question is which access keys should I use? I am confused by this IAM which I have never used before. At the same time, I appreciate having more granular User Authorization controls.

I have the following buckets setup in the same S3 account.

  • webapp-cdn : this is for LIVE server
  • webapp-stage: this is for Staging server
  • webapp-devt: this is for testing during development

I have tried exploring Role in IAM. It appears to be unsuitable.

I am not sure what is best. Ideally I prefer to have 1 unique pair of access key for each bucket. This is to reduce chances of developers leaking keys to the bucket responsible for the LIVE server.

I have read the FAQ but it confused me further than enlightened me.

Please advise.

Thank you.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.