AWS Storage Gateway User Guide
Using Identity-Based Policies (IAM Policies)
In the preceding policy, instead of a using a wildcard character (*), you can scope resources covered by
the policy to a specific gateway, as shown in the following example. The policy then allows the actions
only on the specific gateway.
"Resource": [
"arn:aws:storagegateway:us-west-2:123456789012:gateway/
gateway-id
/",
"arn:aws:storagegateway:us-west-2:123456789012:gateway/
gateway-id
/*"
]
Within a gateway, you can further restrict the scope of the resources to only the gateway volumes, as
shown in the following example:
"Resource": "arn:aws:storagegateway:us-west-2:123456789012:gateway/
gateway-id
/volume/*"
Example 3: Allow Access to a Specific Gateway
The following policy allows all actions on a specific gateway. The user is restricted from accessing other
gateways you might have deployed.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowReadOnlyAccessToAllGateways",
"Action": [
"storagegateway:List*",
"storagegateway:Describe*"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Sid": "AllowsUserToDescribeSnapshotsOnAllGateways",
"Action": [
"ec2:DescribeSnapshots"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Sid": "AllowsAllActionsOnSpecificGateway",
"Action": [
"storagegateway:*"
],
"Effect": "Allow",
"Resource": [
"arn:aws:storagegateway:us-west-2:123456789012:gateway/
gateway-id
/",
"arn:aws:storagegateway:us-west-2:123456789012:gateway/
gateway-id
/*"
]
}
]
}
The preceding policy works if the user to which the policy is attached uses either the API or an AWS SDK
to access the gateway. However, if the user is going to use the Storage Gateway console, you must also
grant permissions to allow the
ListGateways
action, as shown in the following example:
{
"Version": "2012-10-17",
"Statement": [
API Version 2013-06-30
303
