Bucket & IAM Permissions

This article contains minimal permissions for the Amazon AWS S3 bucket required to use the bucket as backup storage in the GitProtect service. The policies provided below allow you to add your own AWS S3 storage to the GitProtect platform, store the backup data there and restore it if needed.

AWS bucket policy

The bucket that will be used to store the data must've assigned the following policy(JSON):

{
     "Version": "2012-10-17",
     "Statement": [
          {
               "Effect": "Allow",
               "Principal": {
                    "AWS": "arn:aws:iam::{account}:user/backup-user"
          },
               "Action": [
                    "s3:ListBucket",
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:DeleteObject"
                
               ],
               "Resource": [
                    "arn:aws:s3:::bucket-name",
                    "arn:aws:s3:::bucket-name/*"
               ]
          }
     ]
}

Support for Immutable Storage

If you want to use the Immutable storage, the following permissions are required:

• s3:GetBucketObjectLockConfiguration - required to read Object Lock

• configuration.s3:GetBucketVersioning - required to read the versioning configuration.

Remember, that the Immutable Storage configuration is available only when creating the new bucket - there is no option to enable Immutable Storage in an already existing bucket!

Retention and/or versioning enabled for the bucket may result in the storage of additional data. It is recommended that the retention in GitProtect be longer than the one set for storage. Otherwise, it may lead to storage being overloaded!

It must be added to the Action section, and after the changes, the section must look like the below:

"Action": [
                    "s3:ListBucket",
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:DeleteObject",
		    "s3:GetBucketVersioning",
	            "s3:GetBucketObjectLockConfiguration"
               ],

More details about how to create or edit a bucket policy available on Amazon documentation:

Adding a bucket policy by using the Amazon S3 console - Amazon Simple Storage ServiceAmazon Simple Storage Service

To see more about S3 Immutable storage, visit:

AWS Security Incident Response Guide - AWS Security Incident Response GuideAWS Security Incident Response Guide