Today I'm playing with the new Amazon S3 Access Points 🙌
It's quite a convenient way to create and manage custom access rules for data stored on S3 without having to maintain a single (complex) bucket access policy 👌
[Thread]
It's quite a convenient way to create and manage custom access rules for data stored on S3 without having to maintain a single (complex) bucket access policy 👌
[Thread]
You can think of an Access Point as a sort of "alias" to your bucket, accessible from the Internet or from a specific VPC.
You can create hundreds of Access Points per bucket to provide access to shared data for different applications, teams, or any other consumer 👥👨💻👩💻
You can create hundreds of Access Points per bucket to provide access to shared data for different applications, teams, or any other consumer 👥👨💻👩💻
These "aliases" don't have to be unique globally, but only per account & region.
So it's quite easy to pick your own Access Point name without worrying about conflicting with other existing applications or environments 🚀
So it's quite easy to pick your own Access Point name without worrying about conflicting with other existing applications or environments 🚀
For example, it could provide restricted read-only access for analysis or write-only access for data ingestion.
Or full access to a sub-path or other subsets of the data.
Or even public access (you'll need to disable "Block public access" on the bucket too).
Or full access to a sub-path or other subsets of the data.
Or even public access (you'll need to disable "Block public access" on the bucket too).
You can also "use" the Access Point directly in the S3 management console. This allows you to easily verify that the Access Point policy works as expected 👌
When you create an Access Point, you can reference it as if it was a regular bucket using the SDK or CLI.
Most data operations are supported - full list here 👉 docs.aws.amazon.com/AmazonS3/lates…
Access Point ARNs look like this 👉 arn:aws:s3:eu-west-1:XXX:accesspoint/my-access-point-name
Most data operations are supported - full list here 👉 docs.aws.amazon.com/AmazonS3/lates…
Access Point ARNs look like this 👉 arn:aws:s3:eu-west-1:XXX:accesspoint/my-access-point-name
Because of the S3 API compatibility, I can easily update my bash/CLI scripts such as:
BUCKETNAME=my-bucket-name
aws s3 ls $BUCKETNAME
by just updating the value of BUCKETNAME with the Access Point ARN 🎉
(note: don't forget to upgrade to the latest AWS CLI version)
BUCKETNAME=my-bucket-name
aws s3 ls $BUCKETNAME
by just updating the value of BUCKETNAME with the Access Point ARN 🎉
(note: don't forget to upgrade to the latest AWS CLI version)
