Access Control Using AWS Identity and Access Management (IAM)

The following policy allows a user to perform all the AWS Storage Gateway actions. The policy also allows the user to perform Amazon EC2 actions (DescribeSnapshots and DeleteSnapshot) on the Amazon EBS snapshots generated from AWS Storage Gateway.

{
   "Statement":[
      {
         "Action": [
            "storagegateway:*"
         ],
         "Effect": "Allow",
         "Resource": "*"
      },
      {
         "Action": [
            "ec2:DescribeSnapshots",
            "ec2:DeleteSnapshot"
         ],
         "Effect": "Allow",
         "Resource": "*"
      }
   ]
}

The following policy allows all List* and Describe* actions on all resources. Note that these actions are read actions. So the policy does not allow the user to change state of any resources—that is, the policy does not allow the user to perform the actions such as DeleteGateway, ActivateGateway, and ShutdownGateway.

The policy also allows the DescribeSnapshots Amazon EC2 action. For more information, go to DescribeSnapshots in the Amazon Elastic Compute Cloud API Reference.

{
  "Statement": [
    {
      "Action": [
        "storagegateway:List*",
        "storagegateway:Describe*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": [
        "ec2:DescribeSnapshots"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

In the preceding policy, instead of a using a wild card, you could scope resources covered by the policy to a specific gateway. The policy would then allow the actions only on the specific gateway.

"Resource": "arn:aws:storagegateway:us-east-1:111122223333:gateway/[Gateway Name]/*" 

Within a gateway, you can further restrict the scope of the resources to only the gateway volumes.

"Resource": "arn:aws:storagegateway:us-east-1:111122223333:gateway/[Gateway Name]/volume/*" 

The following policy allows all actions on a specific gateway. That is, the user is restricted from accessing other gateways you might have deployed.

{
  "Statement": [
    {
      "Action": [
        "storagegateway:*"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:storagegateway:[AWS Region]:[AWS Account]:gateway/[Gateway Name]/*"
    }
  ]
}

The preceding policy works if the user to whom the policy is attached uses either the API or an AWS SDK to access the gateway. However, if this user plans to use the AWS Storage Gateway console, you must also grant permission to the ListGateways action.

{
  "Statement": [
    {
      "Action": [
        "storagegateway:*"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:storagegateway:[AWS Region]:[AWS Account]:gateway/[Gateway Name]/*"
    },
    {
      "Action": [
        "storagegateway:ListGateways"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Additionally, if the user plans to activate the specific gateway, you must also grant permission to the ActivateGateway action.

{
  "Statement": [
    {
      "Action": [
        "storagegateway:*"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:storagegateway:[AWS Region]:[AWS Account]:gateway/[Gateway Name]/*"
    },
    {
      "Action": [
        "storagegateway:ListGateways", 
        "storagegateway:ActivateGateway"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

The following policy allows a user all actions to a specific volume on a gateway. Because a user does not get any permissions by default, the policy restricts the user to accessing only a specific volume.

{
  "Statement": [
    {
      "Action": [
        "storagegateway:*"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:storagegateway:[AWS Region]:[AWS Account]:gateway/[Gateway Name]/volume/[Volume Name]"
    }
  ]
}

The following policy allows a user to perform all action on gateways whose name starts with "DeptX". The policy also allows the DescribeSnapshots Amazon EC2 action.

{
  "Statement": [
    {
      "Action": [
        "storagegateway:*"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:storagegateway:[AWS Region]:[AWS Account]:gateway/[Gateway Name Prefix]*"
    },
    {
      "Action": [
        "ec2:DescribeSnapshots"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

The preceding policy works if the user to whom the policy is attached uses either the API or an AWS SDK to access the gateway. However, if this user plans to use the AWS Storage Gateway console, you must grant additional permissions as described in 3: Allow access to a specific gateway.