AWS Storage Gateway User Guide
Using Identity-Based Policies (IAM Policies)
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowsSpecifiedEC2ActionOnAllGateways",
"Effect": "Allow",
"Action": [
"ec2:DescribeSnapshots"
],
"Resource": "*"
}
]
}
This additional permission is required because the Amazon EBS snapshots generated from Storage
Gateway are managed as Amazon EC2 resources.
To set up the minimum permissions required to navigate the Storage Gateway console, see
Allow Read-Only Access to a Gateway (p. 302)
.
AWS Managed Policies for Storage Gateway
AWS addresses many common use cases by providing standalone IAM policies that are created and
administered by AWS. Managed policies grant necessary permissions for common use cases so you can
avoid having to investigate what permissions are needed. For more information about AWS managed
policies, see
IAM User Guide
.
The following AWS managed policies, which you can attach to users in your account, are specific to
Storage Gateway:
•
AWSStorageGatewayReadOnlyAccess
– Grants read-only access to AWS Storage Gateway resources.
•
AWSStorageGatewayFullAccess
– Grants full access to AWS Storage Gateway resources.
Note
You can review these permissions policies by signing in to the IAM console and searching for
specific policies there.
You can also create your own custom IAM policies to allow permissions for AWS Storage Gateway API
actions. You can attach these custom policies to the IAM users or groups that require those permissions.
Customer Managed Policy Examples
In this section, you can find example user policies that grant permissions for various Storage Gateway
actions. These policies work when you are using AWS SDKs and the AWS CLI. When you are using
the console, you need to grant additional permissions specific to the console, which is discussed in
Permissions Required to Use the Storage Gateway Console (p. 300)
.
Note
All examples use the US West (Oregon) Region (
us-west-2
) and contain fictitious account IDs.
Topics
•
Example 1: Allow Any Storage Gateway Actions on All Gateways (p. 302)
•
Example 2: Allow Read-Only Access to a Gateway (p. 302)
•
Example 3: Allow Access to a Specific Gateway (p. 303)
•
Example 4: Allow a User to Access a Specific Volume (p. 304)
•
Example 5: Allow All Actions on Gateways with a Specific Prefix (p. 305)
API Version 2013-06-30
301
