Users, Groups, and Policies

This page covers day-to-day IAM administration: creating users and groups, attaching policies, and writing custom policy documents.

Managing Users

Users can be managed from the Console (Identity section in the left navigation) or through the admin REST API. All admin endpoints live under the /rustfs/admin/v3 prefix; a MinIO-compatible prefix (/minio/admin) is also served for mc admin / madmin-style clients. Requests must be signed (AWS Signature V4) by a credential whose policies allow the corresponding admin:* action.

Managing Groups

Groups collect users so a single policy binding covers all members. Group membership and status are managed with these endpoints (Console equivalents exist under Identity):

Membership update body:

{
  "group": "developers",
  "members": ["alice", "bob"],
  "isRemove": false
}

Set isRemove to true to remove the listed members instead. Temporary (STS) users and the root credential cannot be added to groups.

Attaching Policies

Policy bindings connect a named policy to a user or a group:

Managing Policy Documents

Policy Document Format

A policy document is a JSON object with Version and Statement fields. The only accepted Version value is 2012-10-17.

Each statement supports:

Action names are namespaced: s3:* for object/bucket operations (e.g. s3:GetObject, s3:PutObject, s3:DeleteObject, s3:ListBucket, s3:GetBucketLocation, s3:ListAllMyBuckets), admin:* for management operations, sts:AssumeRole for STS, and kms:* for key management.

Supported condition operators include: StringEquals, StringNotEquals, StringEqualsIgnoreCase, StringNotEqualsIgnoreCase, StringLike, StringNotLike, ArnEquals, ArnNotEquals, ArnLike, ArnNotLike, BinaryEquals, IpAddress, NotIpAddress, Null, Bool, NumericEquals, NumericNotEquals, NumericLessThan, NumericLessThanEquals, NumericGreaterThan, NumericGreaterThanEquals, DateEquals, DateNotEquals, DateLessThan, DateLessThanEquals, DateGreaterThan, and DateGreaterThanEquals. Any operator can be suffixed with IfExists (the condition passes when the referenced context key is absent).

Example: Read-Only Access to One Bucket

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetBucketLocation", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::reports"]
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::reports/*"]
    }
  ]
}

Example: Read/Write Restricted to a Prefix

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::app-data"],
      "Condition": {
        "StringLike": {
          "s3:prefix": ["tenant-42/*"]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": ["arn:aws:s3:::app-data/tenant-42/*"]
    }
  ]
}

Example: Full Access but Deletion Denied

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:*"],
      "Resource": ["arn:aws:s3:::archive", "arn:aws:s3:::archive/*"]
    },
    {
      "Effect": "Deny",
      "Action": ["s3:DeleteObject", "s3:DeleteObjectVersion", "s3:DeleteBucket"],
      "Resource": ["arn:aws:s3:::archive", "arn:aws:s3:::archive/*"]
    }
  ]
}

Built-In Policies

RustFS defines five built-in policies that can be attached without creating them first: