github.com/atlassian/git-lob@v0.0.0-20150806085256-2386a5ed291a/doc/s3_setup.md (about)

     1  # S3 Recommended Setup #
     2  
     3  By default all resources in S3 are private to the account. While you can assign
     4  ACLs explicitly to allow other people access, you have to do this with each
     5  upload which can be awkward. It's actually much easier to share resources with
     6  a specific team by using a main organisation Amazon account, then creating an
     7  AWS Identity and Access Management (IAM) user in your AWS account.
     8  
     9  This way not only do these sub-accounts have access to your S3 bucket, but any
    10  objects they create are automatically owned by the root account. This means
    11  you always have control over the objects created by the team from this root
    12  account.
    13  
    14  [Amazon's documentation on access control](https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-overview.html)
    15  
    16  ## Create a bucket ##
    17  
    18  First, just create a bucket in your root S3 account the usual way. 
    19  
    20  ## Create a group ##
    21  
    22  1. Open the AWS console as the root account
    23  2. Click Identity and Access Management
    24  3. Click Groups in the sidebar
    25  4. Click Create New Group
    26  5. Give it a name appropriate for read/write access e.g. 'git-lob.rw'
    27  6. If you want to give the group access to ALL buckets, scroll down and check 
    28     the box next to AmazonS3FullAccess & click Next
    29     If you want to give the group access to only specific buckets, don't check
    30     any boxes, just click Next
    31  7. Proceed to confirm the group
    32  
    33  ## Give specific bucket permissions to the group ##
    34  
    35  If you didn't grant access to every bucket in step 6 above, you need to add an
    36  Inline Policy in the group details (at the bottom of the group details) to allow
    37  this group to have permissions to your git-lob bucket.
    38  
    39  1. Create an Inline Policy in the bottom section
    40  2. Select Policy Generator
    41  3. Set the following options: <br/>
    42        Effect: Allow<br/>
    43        AWS Service: Amazon S3<br/>
    44        Actions: All Actions<br/>
    45        Amazon Resource Name (ARN): arn:aws:s3:::*[bucket_name]*, arn:aws:s3:::*[bucket_name]*/*
    46  4. Click Add Statement then Next
    47  5. Give it a meaningful name e.g. 'Readwrite_git-lob' then Apply Policy 
    48  
    49  ##Create read-only permissions if you want ##
    50  
    51  If you want to, you can either open permissions read-only to the bucket to 
    52  everyone, or you can repeat the steps above to give read-only access to 
    53  another group that you create. 
    54  
    55  ## Create users ##
    56  
    57  You want to create a user underneath this root account for everyone who will
    58  be granted access - including you. You should use your user credentials
    59  rather than your root credentials in all normal usage.
    60  
    61  1. Back at the Identiry and Access Management root, click Users in the sidebar
    62  2. Enter up to 5 user names and keep the 'Generate access key' checkbox enabled
    63  3. Click Create, then make a note of the key pairs for these users 
    64  4. Distribute the key pairs securely to the users in question
    65  5. Go back to the Groups section in the sidebar and assign the users to the
    66     read/write group you created earlier (or the read-only group if you added 
    67     one)
    68  
    69  ## Choosing what credentials to use at runtime ##
    70  
    71  There's a good chance that at least one of your users will end up having more
    72  than one S3 account so will need to choose which one to use. To manage this, 
    73  create multiple profiles in your AWS configuration files, stored in 
    74  ~/.aws/ (config and credentials files). Both files can have sections for 
    75  different profiles, the default settings being under [default]
    76  
    77  You can choose which profile to use at any given time multiple ways:
    78  
    79  1. Set it per remote in .git/config:
    80     git config remote.*[remote_name]*.git-lob-s3-profile *[profile_name]*
    81  2. Set it per repo or globally for git only
    82     git config git-lob.s3-profile *[profile_name]*
    83  3. Set AWS_PROFILE in your environment
    84  
    85  So you could put the new credentials for this user into a new section of your
    86  ~/.aws/credentials file, then set your git config (per remote, per repo or
    87  globally) to specify this profile, thus using the correct setup without
    88  affecting any other usage of S3 you have.
    89