Thanks to Adam Shane for providing direction in previous post. I'm going to add on here so future searchers don't have to read through our conversation.
I've outlined the steps to configure an S3 disk group using Amazon S3 (note this is not necessarily a strict guide, just the outline of steps as I've worked through them)
General steps
AWS
- Create S3 bucket
- Each bucket will correspond to an OnBase disk group
- Create two policies - one will be used during initial setup the other will be used ongoing. I refer to these as Admin and Ongoing
- I chose to create two policies. Could also use the Amazon managed AmazonS3FullAccess policy during initial setup
- Create AWS user (programmatic access)
- Save credentials - do not lose these and do not store them where someone can get to them
- Attach appropriate Admin or AmazonS3FullAccess Policy
OnBase
- Configure Provider Settings
- Provider URL will be the S3 region. For example: https://s3.us-east-2.amazonaws.com/
- Enter Access Key and Secret key obtained when creating AWS user
- S3 Provider Type: Moderate Compatibility
- Create S3 Disk Group as needed
- Select previously created Provider - appears can also create Provider during S3 Disk Group creation - I did these steps separately
- Select Bucket
Once configured and tested, take away excess privileges by utilizing the Ongoing policy
Admin Policy - used during initial setup/configuration of disk group(s) - JSON
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:GetEncryptionConfiguration",
"s3:ListBucketMultipartUploads",
"s3:AbortMultipartUpload",
"s3:DeleteObject"
],
"Resource": [
"arn:aws:s3:::<your s3 bucket name here>",
"arn:aws:s3:::<your s3 bucket name here>/*"
]
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
}
]
}
Ongoing Policy - used for ongoing usage - JSON
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:GetEncryptionConfiguration",
"s3:ListBucketMultipartUploads",
"s3:AbortMultipartUpload",
"s3:ListBucket",
"s3:DeleteObject"
],
"Resource": [
"arn:aws:s3:::<your s3 bucket name here>",
"arn:aws:s3:::<your s3 bucket name here>/*"
]
}
]
}
For clarity: under Resource the <your s3 bucket name here> would look something like onbase-ep3-diskgroup
- no angles 🙂
Hope this helps someone.
Steve
