Question about Tigris bucket access and IAM policies

Hi Tigris community,

I have a question regarding IAM policies.

I currently have an access key that allows me to edit a specific bucket, and I can interact with all resources in that bucket.

Now, if I attach a policy that allows interaction only with a specific path within the bucket, does this policy stack with the existing permissions (and is therefore mostly redundant), or does the policy take precedence?

If the policy takes precedence, then is access to everything allowed by default?

I’m trying to understand the exact behavior so I can safely design workflows with minimal permissions.

Thanks!

Solution

Hello,

If the buckets<>role grants the access to the operation, it will be allowed. If this remains indecisive or denied, it will fall back to IAM policies evaluation.

We generally see users using either of these mechanisms to form the access for their keys. The documentation will be updated to cover this.

Thanks!

Follow-up Question

So just to confirm: if I want an access key that only has edit access to a certain path in a bucket, I don’t need to assign bucket roles at all, and should rely only on an IAM policy for that restriction, right?

Response

Right.