pshell and S3 remotes

Owned by Sean Fleming
Last updated: Nov 22, 2024

Introduction

This page is specific to S3 remote types (eg acacia and AWS) it does not apply to the more specialised banksia service. If you need more sophisticated policies and lifecycles, you can use the generated ones shown here as a starting point but will have to use awscli to add any customisations. Please refer to Acacia access and identities and Using policies for more details.

Setup

An acacia project can be added to your list of pshell remotes by using an arbitrary remote name (eg project123) and supplying the access/secret pair after you select the remote and login. After this, the usual file and folder commands will be available.

 Example...
pshell:/> remote project123 s3 https://projects.pawsey.org.au
pshell:/> remote project123

project123:/>login
Access: xyz
Secret: ***

Policies

Simple S3 policies can also be automatically created for you, noting that:

  1. Policies are attached to buckets and are a list of statements about actions allowed or denied for that bucket only.
  2. Policies override the default project permissions so care should be taken not to lock yourself out of the bucket.
  3. Any DENY in a policy statement counts as a negative permission overall for that action, even if there is also an ALLOW elsewhere.
  4. Policies only grant visibility of objects in a bucket, not visibility of the bucket itself.

You can use the pshell command "info mybucket" to examine the active policies on that bucket.

 Examples...
Example1 - give a list of Pawsey users readonly access
project123:/>policy my-bucket +r user1,user2,user3,user4
Setting bucket=my-bucket, perm=+r, for user(s)='user1,user2,user3,user4'

Note: if a user attempts to list buckets they will see nothing. However, if they attempt to list objects inside the bucket it will show the objects inside my-bucket/ - see Note 4.


Example 2 - revoke user3 from having read access
project123:/>policy my-bucket -r user3
Setting bucket=my-bucket, perm=-r, for user(s)='user3'


Example 3 -  grant read and write permission
project123:/>policy my-bucket +rw user1
Setting bucket=my-bucket, perm=+rw, for user(s)='user1'
Example 4 - make a bucket readonly and publicly accessible
project123:/>policy my-bucket +r *
Setting bucket=my-bucket, perm=+r, for user(s)=None
Example 5 - remove all policies on a bucket
project123:/>policy my-bucket -
Deleting all policies on bucket=my-bucket

Lifecycles

Simple S3 bucket lifecycles can also be automatically created for you affecting multi-part uploads and versioning.

Use the pshell command "info mybucket" to check if there are any current lifecycle rules as the following may overwrite them.


 Examples...
Example 1 - enable multi-part and expired version cleanup after 30 days
pshell> lifecycle my-bucket +mv
Example 2 - clean up incomplete multi-part uploads after 7 days
pshell> lifecycle my-bucket +m 7


Example 3 - turn on versioning and delete expired non-current objects after 30 days
pshell> lifecycle my-bucket +v 30

If versioning is enabled on a bucket, then you will have the option to review and restore deleted objects in the window before the lifecycle cleanup policy permanently removes them.

Example 4 - Reviewing deleted objects
pshell> lifecycle my-bucket --review
Reviewing deletions: bucket=my-bucket, prefix=
 * folder1/my_file.txt
Example 5 - Restoring an object
pshell> lifecycle my-bucket/folder1 --restore
Restoring deletions: bucket=my-bucket, prefix=folder1
restoring: folder1/my_file.txt
Restored object count: 1