8

AWS IAM CLI

chrislusf edited this page 2025-12-14 17:29:15 -08:00

Table of Contents

• AWS IAM CLI with SeaweedFS
• Installation
• Prerequisites
• 1. Start SeaweedFS with S3/IAM
• 2. Create Admin Credentials
• 3. Configure AWS CLI
• User Management
• Create a User
• List Users
• Get User Details
• Delete User
• Enable/Disable User
• Access Key Management
• Create Access Key
• List Access Keys
• Delete Access Key
• Update Access Key Status
• Self-Service: Manage Your Own Keys
• Policy Management
• Create and Attach a Read-Only Policy
• Create Read-Write Policy for Specific Bucket
• Get User Policy
• Delete User Policy
• Verify Configuration
• Complete Workflow Example
• Related Documentation

AWS IAM CLI with SeaweedFS

This guide shows how to use the AWS CLI to manage IAM users, access keys, and policies in SeaweedFS.

Installation

See AWS-CLI-with-SeaweedFS for AWS CLI installation instructions.

Prerequisites

1. Start SeaweedFS with S3/IAM

The IAM API is embedded in the S3 server by default:

# Start with embedded IAM (default)
weed s3 -filer=localhost:8888

# Or with weed server
weed server -s3

2. Create Admin Credentials

Create an admin user to manage IAM:

echo 's3.configure -apply -user admin -access_key admin_access_key -secret_key admin_secret_key -actions Admin' | weed shell

3. Configure AWS CLI

Set the endpoint to your S3 server (IAM uses the same endpoint):

export AWS_ACCESS_KEY_ID=admin_access_key
export AWS_SECRET_ACCESS_KEY=admin_secret_key

# IAM and S3 use the same endpoint
export AWS_ENDPOINT=http://localhost:8333

---

User Management

Create a User

aws --endpoint $AWS_ENDPOINT iam create-user --user-name bob

Output:

{
    "User": {
        "UserName": "bob"
    }
}

List Users

aws --endpoint $AWS_ENDPOINT iam list-users

Output:

{
    "Users": [
        { "UserName": "admin" },
        { "UserName": "bob" }
    ]
}

Get User Details

aws --endpoint $AWS_ENDPOINT iam get-user --user-name bob

Delete User

aws --endpoint $AWS_ENDPOINT iam delete-user --user-name bob

Enable/Disable User

Disable or re-enable a user without deleting them:

# Disable a user (all their access keys will stop working)
aws --endpoint $AWS_ENDPOINT iam set-user-status --user-name bob --status Inactive

# Re-enable the user
aws --endpoint $AWS_ENDPOINT iam set-user-status --user-name bob --status Active

---

Access Key Management

Create Access Key

aws --endpoint $AWS_ENDPOINT iam create-access-key --user-name bob

Output:

{
    "AccessKey": {
        "UserName": "bob",
        "AccessKeyId": "X8R439UM7OSQJX28I9QTP",
        "Status": "Active",
        "SecretAccessKey": "FLh9yeeYhzA7qsiyLIXsvuhv4g2cSgoUJJe/EqZw1z"
    }
}

List Access Keys

aws --endpoint $AWS_ENDPOINT iam list-access-keys --user-name bob

Output:

{
    "AccessKeyMetadata": [
        {
            "UserName": "bob",
            "AccessKeyId": "X8R439UM7OSQJX28I9QTP",
            "Status": "Active"
        }
    ]
}

Delete Access Key

aws --endpoint $AWS_ENDPOINT iam delete-access-key --user-name bob --access-key-id X8R439UM7OSQJX28I9QTP

Update Access Key Status

Deactivate or reactivate an access key without deleting it:

# Deactivate an access key
aws --endpoint $AWS_ENDPOINT iam update-access-key \
  --user-name bob \
  --access-key-id X8R439UM7OSQJX28I9QTP \
  --status Inactive

# Reactivate the access key
aws --endpoint $AWS_ENDPOINT iam update-access-key \
  --user-name bob \
  --access-key-id X8R439UM7OSQJX28I9QTP \
  --status Active

Self-Service: Manage Your Own Keys

Users can manage their own access keys without admin privileges:

# Set credentials for the user
export AWS_ACCESS_KEY_ID=bob_access_key
export AWS_SECRET_ACCESS_KEY=bob_secret_key

# Create a new key for yourself (no --user-name needed)
aws --endpoint $AWS_ENDPOINT iam create-access-key

# List your own keys
aws --endpoint $AWS_ENDPOINT iam list-access-keys

---

Policy Management

Create and Attach a Read-Only Policy

# Create policy document
cat > readonly-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:Get*",
        "s3:List*"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}
EOF

# Attach to user
aws --endpoint $AWS_ENDPOINT iam put-user-policy \
  --user-name bob \
  --policy-name ReadOnlyPolicy \
  --policy-document file://readonly-policy.json

Create Read-Write Policy for Specific Bucket

cat > readwrite-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:Get*",
        "s3:Put*",
        "s3:Delete*",
        "s3:List*"
      ],
      "Resource": [
        "arn:aws:s3:::data-bucket",
        "arn:aws:s3:::data-bucket/*"
      ]
    }
  ]
}
EOF

aws --endpoint $AWS_ENDPOINT iam put-user-policy \
  --user-name bob \
  --policy-name DataBucketAccess \
  --policy-document file://readwrite-policy.json

Get User Policy

aws --endpoint $AWS_ENDPOINT iam get-user-policy \
  --user-name bob \
  --policy-name ReadOnlyPolicy

Delete User Policy

aws --endpoint $AWS_ENDPOINT iam delete-user-policy \
  --user-name bob \
  --policy-name ReadOnlyPolicy

---

Verify Configuration

Check the current S3/IAM configuration:

echo 's3.configure' | weed shell

Output:

{
  "identities": [
    {
      "name": "admin",
      "credentials": [
        {
          "accessKey": "admin_access_key",
          "secretKey": "admin_secret_key"
        }
      ],
      "actions": ["Admin"]
    },
    {
      "name": "bob",
      "credentials": [
        {
          "accessKey": "X8R439UM7OSQJX28I9QTP",
          "secretKey": "FLh9yeeYhzA7qsiyLIXsvuhv4g2cSgoUJJe/EqZw1z"
        }
      ],
      "actions": [
        "Read:my-bucket",
        "List:my-bucket"
      ]
    }
  ]
}

---

Complete Workflow Example

# 1. Set admin credentials
export AWS_ACCESS_KEY_ID=admin_key
export AWS_SECRET_ACCESS_KEY=admin_secret
export AWS_ENDPOINT=http://localhost:8333

# 2. Create a new user
aws --endpoint $AWS_ENDPOINT iam create-user --user-name alice

# 3. Create access key for the user
aws --endpoint $AWS_ENDPOINT iam create-access-key --user-name alice

# 4. Create a read-only policy
cat > alice-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:Get*", "s3:List*"],
      "Resource": ["arn:aws:s3:::shared-bucket/*"]
    }
  ]
}
EOF

# 5. Attach policy to user
aws --endpoint $AWS_ENDPOINT iam put-user-policy \
  --user-name alice \
  --policy-name SharedBucketReadOnly \
  --policy-document file://alice-policy.json

# 6. Verify
echo 's3.configure' | weed shell

---

Related Documentation

• Amazon IAM API - IAM API reference
• S3 Credentials - Credential management options
• AWS CLI with SeaweedFS - General AWS CLI setup
• S3 Configuration - S3 server configuration

Introduction

• Quick Start with weed mini
• Components
• Getting Started
• Production Setup
• Benchmarks
• FAQ
• Applications

API

• Master Server API
• Volume Server API
• Filer Server API
• Client Libraries
• SeaweedFS Java Client

Configuration

• Replication
• Store file with a Time To Live
• Failover Master Server
• Erasure coding for warm storage
• Server Startup via Systemd
• Environment Variables

Filer

• Filer Setup
• Directories and Files
• File Operations Quick Reference
• Data Structure for Large Files
• Filer Data Encryption
• Filer Commands and Operations
• Filer JWT Use
• TUS Resumable Uploads

Filer Stores

• Filer Cassandra Setup
• Filer Redis Setup
• Super Large Directories
• Path-Specific Filer Store
• Choosing a Filer Store
• Customize Filer Store

Management

• Admin UI
• Worker

Advanced Filer Configurations

• Migrate to Filer Store
• Add New Filer Store
• Filer Store Replication
• Filer Active Active cross cluster continuous synchronization
• Filer as a Key-Large-Value Store
• Path Specific Configuration
• Filer Change Data Capture

FUSE Mount

• FIO benchmark
• fstab

WebDAV

Cloud Drive

• Cloud Drive Benefits
• Cloud Drive Architecture
• Configure Remote Storage
• Mount Remote Storage
• Cache Remote Storage
• Cloud Drive Quick Setup
• Gateway to Remote Object Storage

AWS S3 API

• Amazon S3 API
• S3 Conditional Operations
• S3 CORS
• S3 Object Lock and Retention
• S3 Object Versioning
• S3 API Benchmark
• S3 API FAQ
• S3 Bucket Quota
• S3 Rate Limiting
• S3 API Audit log
• S3 Nginx Proxy
• Docker Compose for S3

S3 Table Bucket

• S3 Table Bucket

S3 Authentication & IAM

• S3 Configuration - Start Here
• S3 Credentials (-s3.config)
• OIDC Integration (-s3.iam.config)
• S3 Policy Variables
• Amazon IAM API
• AWS IAM CLI

Server-Side Encryption

• Server-Side Encryption
• Server-Side Encryption SSE-KMS
• Server-Side Encryption SSE-C

S3 Client Tools

• AWS CLI with SeaweedFS
• s3cmd with SeaweedFS
• rclone with SeaweedFS
• restic with SeaweedFS
• nodejs with Seaweed S3

Machine Learning

• TensorFlow with SeaweedFS

HDFS

• Hadoop Compatible File System
• run Spark on SeaweedFS
• run HBase on SeaweedFS
• run Presto on SeaweedFS
• Hadoop Benchmark
• HDFS via S3 connector

Replication and Backup

• Async Replication to another Filer [Deprecated]
• Async Backup
• Async Filer Metadata Backup
• Async Replication to Cloud [Deprecated]
• Kubernetes Backups and Recovery with K8up

Metadata Change Events

• Filer Metadata Events
• Filer Notification Webhook

Messaging

• Structured Data Lake with SMQ and SQL
• Seaweed Message Queue
• SQL Queries on Message Queue
• SQL Quick Reference
• PostgreSQL-compatible Server weed db
• Pub-Sub to SMQ to SQL
• Kafka to Kafka Gateway to SMQ to SQL

Use Cases

• Use Cases
• Actual Users

Operations

• System Metrics
• weed shell
• Data Backup
• Deployment to Kubernetes and Minikube

Advanced

• Large File Handling
• Optimization
• Volume Management
• Tiered Storage
• Cloud Tier
• Cloud Monitoring
• Load Command Line Options from a file
• SRV Service Discovery
• Volume Files Structure

Security

• Security Overview
• Security Configuration
• Cryptography and FIPS Compliance
• Run Blob Storage on Public Internet

Misc Use Case Examples

• UrBackup with SeaweedFS
• Docker Image Registry with SeaweedFS
• SeaweedFS in Docker Swarm
• Words from SeaweedFS Users
• Independent Benchmarks
• Hardware