Cyberduck Mountain Duck CLI

Version 7 (modified by dkocher, on Mar 7, 2011 at 8:21:49 PM) (diff)

--

Cyberduck Help / Howto / AWS Identity & Access Management (IAM)

Notes on using IAM credentials to access S3 with Cyberduck. IAM allows you to create credentials for third parties accessing your S3 account with permission constraints.

IAM Tools Setup

  • Download the IAM Command Line Toolkit. Unzip the download and move the folder IAMCli-1.2.0 into the bin folder in your user home directory.
  • In a Terminal.app window, set the home environment for IAM
echo 'export AWS_IAM_HOME=~/bin/IAMCli-1.2.0' >> ~/.bash_profile
  • Set the environment variable to point to the credentials file.
    echo 'export AWS_CREDENTIAL_FILE=$AWS_IAM_HOME/aws-credential.template' >> ~/.bash_profile
    
  • Add the path to the IAM programs to your path
echo 'export PATH=$AWS_IAM_HOME/bin:$PATH' >> ~/.bash_profile
  • Update the environment of the current shell (alternatively open a new Terminal.app window).
. ~/.bash_profile
  • Edit the credentials file aws-credential.template with your AWS identifiers.

Create a new IAM user

Add a new IAM user and generate the access credentials. This will print out the Access Key ID and Secret Access Key to use when logging in with Cyberduck.

iam-usercreate -u <username>;iam-useraddkey -u <username>

Attach a policy

Add a new policy for the user. This example gives the user access to all of your S3 resources.

iam-useraddpolicy  -u <username> -e Allow -a s3:* -r arn:aws:s3:::* -o -p `uuidgen`

Restrict access to a specific bucket

iam-useraddpolicy  -u <username> -e Allow -a s3:* -r arn:aws:s3:::bucketname -o -p `uuidgen`
iam-useraddpolicy  -u <username> -e Allow -a s3:* -r arn:aws:s3:::bucketname/* -o -p `uuidgen`
swiss made software