- [Instructor] Okay, so now let's walk through
a demo of applying a resource policy.
Again, I'm logged into the console.
From here, this particular demo, I'm going to apply
a Resource Policy
to an S3 bucket.
So, from here, I'm gonna go to the S3 service.
And you can see, I have a number of buckets
that I've created over time from various different projects.
And one example, for this demo: We're going to take
a look at my TalentedMrJones.com bucket.
So this particular bucket is where I host
my TalentedMrJones.com website.
I have this bucket configured to host a static website
but there's one thing that I need to do in order to allow
anonymous users the ability
to read the things from that bucket.
So, I'm going to click through to that bucket
and I'm going to click on the properties of it.
So, I'm looking at the properties of the bucket itself.
You can see I have a number
of different objects within the bucket.
And in order for anonymous users to be able to read this
I need to go Permissions and Add A Bucket Policy.
So, from here, I'm going to Add A Bucket Policy.
Now, I could copy and paste in here,
if I already had it available, which I don't.
So, I'm going to click the Policy Generator
and from here you can see that there are
a number of services that allow us to create
and these aren't all of them.
There are other services that allow us
to create resource-based policies.
I'm going to choose the S3 Bucket Policy.
I'm going to Allow.
I'm going to put * for anyone.
That means, essentially, anonymous users.
Everyone is allowed to:
I'm going to choose a very specific action here
called GetObject.
Just that one action will allow them to download an object
if you already know about it.
If you don't, if you want to list the contents of the bucket
that's a completely different permission.
In this case, we don't need them to do that.
All we need is to allow them to download particular objects.
So, I'm gonna choose that one.
I'm going to say that they're allowed to do this
on this particular bucket, not any bucket, but this one.
So, I'm going to say ARN:
AWS
:
S3
I don't need the regions and account numbers
and things like that.
I'm going to say
:::
the name of the bucket
talentedmrjones.com
and then, it's very important here at the end that we ...
We're not talking about the bucket itself,
but objects in the bucket.
So /* in this case will allow the user
to download objects within the bucket.
So I'm going to add that statement.
You can see here:
We're allowing everyone, anonymous users
the ability to download objects from S3
from anywhere within this particular bucket.
So I'm gonna go ahead and generate that policy.
I'm going to
highlight,
copy
come back over here to
the S3 console.
I'm gonna paste that here and I'm going to click Save.
And you can see the little green check that came up there.
The fact that we got that green check and this went away
means that the policy is valid.
And now you can see that this has changed from
Add A Bucket Policy to Edit Bucket Policy.
And that is how we create and apply
a resource-based policy.
Again, we've done this on an S3 bucket,
but we could have very well have done this on
a simple Queue Service queue, a DynamoDB table
or various other Amazon services.