Customize the Default Data Consumer Policy

As a Storage Manager or Storage Account Owner, you can change the default policy version for the default IAM roles of an ARTESCA account (Storage Account Owner and Data Consumer).

Prerequisites

An IAM account with id 123456789012 with an active Storage manager or Storage Account Owner session credentials (or admin access).

Procedure

Note

  • Remove the optional --set-as-default parameter to create a new policy version without setting it as the default (active) one.

  • The newPolicy.json file contains the new policy document with new permissions.

aws iam create-policy-version --policy-arn arn:aws:iam::123456789012:policy/scality-internal/data-consumer-policy --policy-document file://newPolicy.json --set-as-default

{
    "PolicyVersion": {
        "CreateDate": "2022-01-01T12:56:03.721Z",
        "VersionId": "v2",
        "IsDefaultVersion": true
    }
}

Post-checks

To check that the IAM Policy is successfully created and set as default:

  • Use the get-policy API or the get-policy-version API with the policy ARN used to check that the default version is the same as the version of the policy you created.

  • Ensure and that the attached policy document is the same as the one you sent to ARTESCA.

  • A Data Consumer can perform actions in accordance to the current default policy.