d217c806ca
The live policy keeps the original backup application. Each new key can abort only inside its own prefix. Assistant: grok Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
75 lines
3.6 KiB
JSON
75 lines
3.6 KiB
JSON
{
|
|
"Version": "2023-04-17",
|
|
"Id": "resource-control-scoped-backup",
|
|
"Statement": [
|
|
{
|
|
"Sid": "BackupBucketProbe",
|
|
"Effect": "Allow",
|
|
"Principal": {"SCW": "application_id:ee80333e-5bab-4a04-85a9-5bdb46b7b3c1"},
|
|
"Action": ["s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration", "s3:ListBucket"],
|
|
"Resource": "railiance-platform-pg-backup",
|
|
"Condition": {"Bool": {"aws:SecureTransport": "true"}}
|
|
},
|
|
{
|
|
"Sid": "BackupListPrefix",
|
|
"Effect": "Allow",
|
|
"Principal": {"SCW": "application_id:ee80333e-5bab-4a04-85a9-5bdb46b7b3c1"},
|
|
"Action": ["s3:ListBucketMultipartUploads", "s3:ListBucketVersions"],
|
|
"Resource": "railiance-platform-pg-backup",
|
|
"Condition": {"StringLike": {"s3:prefix": ["platform-pg/", "platform-pg/*"]}}
|
|
},
|
|
{
|
|
"Sid": "BackupObjectsUnderPrefix",
|
|
"Effect": "Allow",
|
|
"Principal": {"SCW": "application_id:ee80333e-5bab-4a04-85a9-5bdb46b7b3c1"},
|
|
"Action": ["s3:AbortMultipartUpload", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:GetObject", "s3:GetObjectVersion", "s3:ListMultipartUploadParts", "s3:PutObject"],
|
|
"Resource": "railiance-platform-pg-backup/platform-pg/*"
|
|
},
|
|
{
|
|
"Sid": "CoulombSocialBackupProbe",
|
|
"Effect": "Allow",
|
|
"Principal": {"SCW": "application_id:681d00bf-b965-4323-b657-97bfde423511"},
|
|
"Action": ["s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration"],
|
|
"Resource": "railiance-platform-pg-backup",
|
|
"Condition": {"Bool": {"aws:SecureTransport": "true"}}
|
|
},
|
|
{
|
|
"Sid": "CoulombSocialBackupList",
|
|
"Effect": "Allow",
|
|
"Principal": {"SCW": "application_id:681d00bf-b965-4323-b657-97bfde423511"},
|
|
"Action": ["s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListBucketVersions"],
|
|
"Resource": "railiance-platform-pg-backup",
|
|
"Condition": {"StringLike": {"s3:prefix": ["platform-pg/application-archives/coulomb-social/", "platform-pg/application-archives/coulomb-social/*"]}}
|
|
},
|
|
{
|
|
"Sid": "CoulombSocialBackupObjects",
|
|
"Effect": "Allow",
|
|
"Principal": {"SCW": "application_id:681d00bf-b965-4323-b657-97bfde423511"},
|
|
"Action": ["s3:AbortMultipartUpload", "s3:GetObject", "s3:GetObjectVersion", "s3:ListMultipartUploadParts", "s3:PutObject"],
|
|
"Resource": "railiance-platform-pg-backup/platform-pg/application-archives/coulomb-social/*"
|
|
},
|
|
{
|
|
"Sid": "EmailConnectBackupProbe",
|
|
"Effect": "Allow",
|
|
"Principal": {"SCW": "application_id:0eb0f958-77a4-4c70-9aa7-14ba46411415"},
|
|
"Action": ["s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration"],
|
|
"Resource": "railiance-platform-pg-backup",
|
|
"Condition": {"Bool": {"aws:SecureTransport": "true"}}
|
|
},
|
|
{
|
|
"Sid": "EmailConnectBackupList",
|
|
"Effect": "Allow",
|
|
"Principal": {"SCW": "application_id:0eb0f958-77a4-4c70-9aa7-14ba46411415"},
|
|
"Action": ["s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:ListBucketVersions"],
|
|
"Resource": "railiance-platform-pg-backup",
|
|
"Condition": {"StringLike": {"s3:prefix": ["platform-pg/application-archives/email-connect/", "platform-pg/application-archives/email-connect/*"]}}
|
|
},
|
|
{
|
|
"Sid": "EmailConnectBackupObjects",
|
|
"Effect": "Allow",
|
|
"Principal": {"SCW": "application_id:0eb0f958-77a4-4c70-9aa7-14ba46411415"},
|
|
"Action": ["s3:AbortMultipartUpload", "s3:GetObject", "s3:GetObjectVersion", "s3:ListMultipartUploadParts", "s3:PutObject"],
|
|
"Resource": "railiance-platform-pg-backup/platform-pg/application-archives/email-connect/*"
|
|
}
|
|
]
|
|
}
|