AWS Storage Gateway, Руководство пользователя

Страница: 314 / 438

AWS Storage Gateway User Guide
Using ACLs for SMB File Share Access
"Action":[
"storagegateway:ActivateGateway"
],
"Resource":"*",
"Condition":{
"StringEquals":{
"aws:RequestTag/Department":"Finance"
}
}
},
{
"Effect":"Allow",
"Action":[
"storagegateway:CreateNFSFileShare",
"storagegateway:CreateSMBFileShare"
],
"Resource":"*",
"Condition":{
"StringEquals":{
"aws:ResourceTag/Department":"Finance",
"aws:RequestTag/Department":"Finance"
}
}
}
]
}
Using Microsoft Windows ACLs to Control Access to
an SMB File Share
In this section, you can find information about how to use Microsoft Windows access control lists (ACLs)
on SMB file shares enabled with Microsoft Active Directory (AD). By using Windows ACLs, you can set
fine-grained permissions on files and folders in your SMB file share.
By default, file gateways support POSIX permissions to control access to files and directories that are
stored through an NFS or SMB file share. For files and directories that are stored through SMB file shares,
file gateways enable you to use Windows ACLs instead of POSIX permissions to control access. This type
of access control simulates Windows ACLs for native Windows file shares.
Following are some important characteristics of Windows ACLs on SMB file shares:
• By default, Windows ACLs on SMB file shares aren't enabled. To enable Windows ACLs, set the
SmbAclEnabled option to
true
for your file share by using the UpdateSMBFileShare operation with
the Storage Gateway SDK or the AWS CLI.
• When ACLs are enabled, the ACL information is persisted in Amazon S3 object metadata.
• The gateway preserves up to 10 ACLs per file or folder.
• When you use an SMB file share enabled with ACLs to access S3 objects created outside your gateway,
the objects inherit ACLs' information from the parent folder.
• The default root ACL for an SMB file share gives full access to everyone, but you can change the
permissions of the root ACL. You can use root ACLs to control access to the file share. You can set who
can mount the file share (map the drive) and what permissions the user gets to the files and folders
recursively in the file share. However, we recommend that you set this permission on the top-level
folder in the S3 bucket so that your ACL is persisted.
You can enable Windows ACLs when you create a new SMB file share by using the CreateSMBFileShare
API operation. Or you can enable Windows ACLs on an existing SMB file share by using the
UpdateSMBFileShare API operation.
API Version 2013-06-30
307