MinIO Authenticate User For Specific Bucket

Question

i am new for MinIO Object Storage.

I want to create a user that can only read and write into x bucket.

I use the default read and write policy but edit the resource into my bucket like below:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::test"
        ]
    }
  ]
}

Then i set my bucket access policy to Private

This my bucket access policy settings

After i was done set the policy of the user and the bucket access policy i went code in NodeJS + ExpressJS

var minioClient = new Minio.Client({
    endPoint: MINIO.URL,
    port: MINIO.PORT,
    useSSL: false,
    accessKey: MINIO.ACCES_KEY,
    secretKey: MINIO.SECRET_KEY
});

const uploadFileStream = async (file) => {
    const fileStream = fs.createReadStream(file.path);
    var fileStat = fs.stat(file.path, function (e, stat) {
        if (e) {
            return console.log(e)
        }
        minioClient.putObject(MINIO.BUCKET_NAME, file.originalname, fileStream, stat.size, file.mimetype, function (e) {
            if (e) {
                return console.log(e)
            }
            console.log("Successfully uploaded the stream")
        })
    })
}

The access key and the secret key was generated using the user service accounts but when i trigger the uploadFileStream function it shows error that the user access is denied

{
  code: 'AccessDenied',
  bucketname: 'test',
  resource: '/test',
  region: 'local-dev-1',
  requestid: '16DDBD16DDDAE918',
  hostid: '9b6e8e2d-b054-41b3-b0ee-5c86ade87200',
  amzRequestid: null,
  amzId2: null,
  amzBucketRegion: null
}

What i should do to make the bucket is only able to be written and read by certain user in MinIO?

Sorry for my bad english.

Answer 1

I have the same issue and i changed my policy to this to allow access to the specified bucket

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
            "s3:*"
        ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::bucket/*", "arn:aws:s3:::bucket"
      ],
      "Sid": "PolicyForBucket"
    }
  ]
}