About bucket policy for immutable storage
Bucket policy protects the metadata objects of immutable storage, such as lockdown-mode.conf and lsu-worm.conf for each volume or sub-bucket. Bucket policy is created and updated automatically when immutable cloud volume is created.
If the bucket already has some bucket policy, cloud administrator needs to merge the existing bucket policy with the policy for immutable storage manually.
Following is the example of bucket policy for immutable storage in AWS S3.
{
"Version": "2012-10-17",
"Id": "vtas-lockdown-mode-file-protection",
"Statement": [
{
"Sid": "vrts-lockdown-file-read-only",
"Effect": "Deny",
"Principal": "*",
"Action": [
"s3:DeleteObject",
"s3:PutObject",
"s3:PutObjectRetention"
],
"Resource": [
"arn:aws:s3:::jzh-worm-05/test01/lockdown-mode.conf",
"arn:aws:s3:::jzh-worm-05/test01/lsu-worm.conf",
"arn:aws:s3:::jzh-worm-05/test02/lockdown-mode.conf",
"arn:aws:s3:::jzh-worm-05/test02/lsu-worm.conf",
"arn:aws:s3:::jzh-worm-05/test03/lockdown-mode.conf",
"arn:aws:s3:::jzh-worm-05/test03/lsu-worm.conf"
],
"Condition": {
"ArnNotEquals": {
"aws:userid": "AIDAID75NQGEKGRLHGU72"
}
}
}
]
}