Sign In to the Console
Amazon Glacier
Developer Guide (API Version 2012-06-01)

AWS Documentation » Amazon Glacier » Developer Guide » Authentication and Access Control for Amazon Glacier » Using Identity-Based Policies for Amazon Glacier (IAM Policies)

Using Identity-Based Policies for Amazon Glacier (IAM Policies)

This topic provides examples of identity-based policies in which an account administrator can attach permissions policies to IAM identities (that is, users, groups, and roles).

Important

We recommend that you first review the introductory topics that explain the basic concepts and options available for you to manage access to your Amazon Glacier resources. For more information, see Overview of Managing Access Permissions to Your Amazon Glacier Resources.

The sections in this topic cover the following:

The following shows an example of a permissions policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "glacier:CreateVault",
        "glacier:DescribeVault",
        "glacier:ListVaults"
      ],
      "Resource": "arn:aws:glacier:us-west-2:123456789012:vaults/*"
    }
  ]
}

The policy grants permissions for three Amazon Glacier vault-related actions (glacier:CreateVault, glacier:DescribeVault and glacier:ListVaults), on a resource using the Amazon Resource Name (ARN) that identifies all of the vaults in the us-west-2 AWS Region.

The wildcard character (*) at the end of the ARN means that this statement can match any vault name. The statement allows the glacier:DescribeVault action on any vault in the specified region, us-west-2. If you want to limit permissions for this action to a specific vault only, you replace the wildcard character (*) with a vault name.

Permissions Required to Use the Amazon Glacier Console

The Amazon Glacier console provides an integrated environment for you to create and manage Amazon Glacier vaults. At a minimum IAM users that you create must be granted permissions for the glacier:ListVaults action to view the Amazon Glacier console as shown in the following example. 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "glacier:ListVaults"     
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Both of the Amazon Glacier AWS Managed policies discussed in the next section grant permissions for glacier:ListVaults.

AWS Managed Policies (Predefined Policies) for Amazon Glacier

AWS addresses many common use cases by providing standalone IAM policies that are created and administered by AWS. Managed policies grant necessary permissions for common use cases so you can avoid having to investigate what permissions are needed. For more information, see AWS Managed Policies in the IAM User Guide.

The following AWS managed policies, which you can attach to users in your account, are specific to Amazon Glacier:

  • AmazonGlacierReadOnlyAccess – Grants read only access to Amazon Glacier through the AWS Management Console.

  • AmazonGlacierFullAccess – Grants full access to Amazon Glacier through the AWS Management Console.

Note

You can review these permissions policies by signing in to the IAM console and searching for specific policies there.

You can also create your own custom IAM policies to allow permissions for Amazon Glacier API actions and resources. You can attach these custom policies to the IAM users or groups that require those permissions or to custom execution roles (IAM roles) that you create for your Amazon Glacier vaults.

Customer Managed Policy Examples

In this section, you can find example user policies that grant permissions for various Amazon Glacier actions. These policies work when you are using Amazon Glacier REST API, the AWS SDKs, the AWS CLI, or, if applicable, the Amazon Glacier management console.

Note

All examples use the US West (Oregon) Region (us-west-2) and contain fictitious account IDs.

Example 1: Allow a User to Download Archives from a Vault

To download an archive, you first initiate a job to retrieve the archive. After the retrieval job is complete, you can download the data. The following example policy grants permissions for the glacier:InitiateJob action to initiate a job (which allows the user to retrieve an archive or a vault inventory from the vault), and permissions for the glacier:GetJobOutput action to download the retrieved data. The policy also grants permissions to perform the glacier:DescribeJob action so that the user can get the job status. For more information, see Initiate Job (POST jobs).

The policy grants these permissions on a vault named examplevault. You can get the vault ARN from the Amazon Glacier console, or programmatically by calling either the Describe Vault (GET vault) or the List Vaults (GET vaults) API actions. 

{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Resource": "arn:aws:glacier:us-west-2:123456789012:vaults/examplevault",
      "Action":["glacier:InitiateJob",
                "glacier:GetJobOutput",
                "glacier:DescribeJob"] 
    }
  ]
}

Example 2: Allow a User to Create a Vault and Configure Notifications

The following example policy grants permissions to create a vault in the us-west-2 region as specified in the Resource element and configure notifications. For more information about working with notifications, see Configuring Vault Notifications in Amazon Glacier. The policy also grants permissions to list vaults in the region and get a specific vault description.

Important

When you grant permissions to create a vault using the glacier:CreateVault operation, you must specify a wildcard character (*) in the Resource value because you don't know the vault name until after you create the vault. 

{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Resource": "arn:aws:glacier:us-west-2:123456789012:vaults/*",
      "Action":["glacier:CreateVault",
                "glacier:SetVaultNotifications",
                "glacier:GetVaultNotifications",
                "glacier:DeleteVaultNotifications",
                "glacier:DescribeVault",
                "glacier:ListVaults"] 
    }
  ]
}

Example 3: Allow a User to Upload Archives to a Specific Vault

The following example policy grants permissions to upload archives to a specific vault in the us-west-2 region. These permissions allow a user to upload an archive all at once using the Upload Archive (POST archive) API operation or in parts using the Initiate Multipart Upload (POST multipart-uploads) API operation. 

{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Resource": "arn:aws:glacier:us-west-2:123456789012:vaults/examplevault",
      "Action":["glacier:UploadArchive",
                "glacier:InitiateMultipartUpload",
                "glacier:UploadMultipartPart",
                "glacier:ListParts",
                "glacier:ListMultipartUploads",
                "glacier:CompleteMultipartUpload"] 
    }
  ]
}

Example 4: Allow a User Full Permissions on a Specific Vault

The following example policy grants permissions for all Amazon Glacier actions on a vault named examplevault. 

{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Resource": "arn:aws:glacier:us-west-2:123456789012:vaults/examplevault",
      "Action":["glacier:*"] 
    }
  ]
}