Seperate account access for Amazon S3 storage?

[fuzzybabybunny]

I want to host files using Amazon's S3. Currently what I like about my regular FTP host is that I can create a new user and give that user access only to a certain subdirectory.

Ex.
Username: contractor
FTP: only given access to /www/contractor_documents/

The user doesn't have access to any other directories except for this one.

Is there a way to do this with S3?

Ex.

In my bucket I have a Photos and Videos directory. The photographer can access the Photos directory, but not the Videos directory.

 

[KLin]

http://aws.amazon.com/s3/faqs/#How_can_I_control_access_to_my_data_stored_on_Amazon_S3

 

[fuzzybabybunny]

http://aws.amazon.com/s3/faqs/#How_can_I_control_access_to_my_data_stored_on_Amazon_S3

Way over my head. I'm looking for more or less a Cpanel where I can just set up an FTP account, specify the username and password and just point it to a directory that I want the user to have access to.

I'm not a developer. I'm just some guy looking for some flexible storage and an easy way to control its access.

 

[KLin]

Amazon S3 probably isn't for you then.

 

[Train]

There may be some 3rd party apps along the lines of what you are doing, but be prepared to pay more than what Amazon is charging.

My company did something similar using Azure storage, for companies to share streaming videos with clients. Setting up and keeping track of all all the pass through validation was a pain, there is no way around it. The problem wih cloud storage is you don't know what server, or even what data center, the cloud provider might use to serve up your content.

You might get lucky and find some open source projects that are heading in that direction. But last I checked, anything out there trying to do this was very rough and was likely a year or more away from being fire up and go ready.

 

[DaveSimmons]

"Bucket Explorer" Team Edition has a way to set up different rights for different users using its own account system instead of Amazon's
http://www.bucketexplorer.com/

For raw S3, you can create limited sub-accounts and only give them read-write access to a specific bucket instead of all of your storage. That's an entire bucket though not just one folder in it.

"CrossFTP" can make that bucket look like FTP storage.
http://www.crossftp.com/

 

[fuzzybabybunny]

"Bucket Explorer" Team Edition has a way to set up different rights for different users using its own account system instead of Amazon's
http://www.bucketexplorer.com/

For raw S3, you can create limited sub-accounts and only give them read-write access to a specific bucket instead of all of your storage. That's an entire bucket though not just one folder in it.

"CrossFTP" can make that bucket look like FTP storage.
http://www.crossftp.com/

Thanks, I'll look into it. Right now it seems like the easiest way to do this is just go register a ton of different buckets and assign a different account to each bucket. The downside being that the buckets are completely independent of each other and don't share the same directory structure at all. Is that what you're getting at?

Or maybe a layman's walkthrough would be nice.

 

[fuzzybabybunny]

I looked at the various different types of explorer apps and I can't justify purchasing a copy of the software for each of my employees just to use Amazon.

I have an S3 account with buckets named Paragon_Media_Share and Paragon_Photographer

I go into the IAM Dashboard and create a new group called Photographers. I want them to only access the Paragon_Photographer bucket.

My policy:

{
  "Statement": [
    {
      "Action": [
        "s3:ListAllMyBuckets"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::*"
    },
    {
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::Paragon_Photographer", "arn:aws:s3:::Paragon_Media_Photographer/*"]
    }
  ]
}

I create a Photographer user, put it into the Photographer Group, record the secret key and the access key, put them into CloudBerry, and I can connect and see the contents of the bucket, but I get Access Denied every time I try and upload anything.

WTF?