Wasabi policy permission

Not sure which of those permissions on that page apply, more than likely the one you mentioned.  Once you have that configured and the permissions assigned to a user in Wasabi you can set the Access Control settings in Wasabi that will allow only the required access.  See here - 

Hello ​@Chris.Childerhose 

Thanks for your answer.

Unfortunately when you clic on Set here, you have a warning say it’s deprecated method.

Ok.  Well best you get in touch with Support for Veeam as well as Wasabi to get it sorted out.

Hi ​@damien commenge,

for VBR i normally create an IAM Policy for a Bucket within the Wasabi Console with this IAM (it’s the 4. Option within your mentioned KB):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:GetBucketVersioning",
        "s3:GetBucketObjectLockConfiguration",
        "s3:ListBucketVersions",
        "s3:GetObjectVersion",
        "s3:GetObjectRetention",
        "s3:GetObjectLegalHold",
        "s3:PutObjectRetention",
        "s3:PutObjectLegalHold",
        "s3:DeleteObjectVersion"
      ],
      "Resource": "*"
    }
  ]
}

After that, i create an User within the Wasabi UI (Type of Access = API key) and attach this created IAM Policy to it.

In this case, the User with this Policy attached have only access to this bucket - and cannot see or browse any other buckets and you should be good to go.

In VBR - you have to specify the exact name of your bucket - otherwise you would end up with this error:

when entering the correct bucket name, then it would be possible to select/browse for a folder (within this bucket):

Hope this would help 😉

Dynamic wrote:

Hi ​@damien commenge,

for VBR i normally create an IAM Policy for a Bucket within the Wasabi Console with this IAM (it’s the 4. Option within your mentioned KB):

 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:GetBucketVersioning",
        "s3:GetBucketObjectLockConfiguration",
        "s3:ListBucketVersions",
        "s3:GetObjectVersion",
        "s3:GetObjectRetention",
        "s3:GetObjectLegalHold",
        "s3:PutObjectRetention",
        "s3:PutObjectLegalHold",
        "s3:DeleteObjectVersion"
      ],
      "Resource": "*"
    }
  ]
}

After that, i create an User within the Wasabi UI (Type of Access = API key) and attach this created IAM Policy to it.

 

In this case, the User with this Policy attached have only access to this bucket - and cannot see or browse any other buckets and you should be good to go.

 

In VBR - you have to specify the exact name of your bucket - otherwise you would end up with this error:

 

when entering the correct bucket name, then it would be possible to select/browse for a folder (within this bucket):

 

Hope this would help 😉

 

 

 

 

Hello ​@Dynamic ,
Thanks for your answer.

I exactly used this policy and work fine but I don’t understand maybe where I have to create it to be sure it applies only to the target bucket ? 
I created it on Wasabi → policy menu.

I should create it on the bucket settings → Permission tab to limit the permission only to this bucket right ?

Then, are you sure about the policy number 4 ? Shouldn’t it be the 6 for health check ?

i’ve written a step by step guide, regards migrating VBO365 from JetDB/Local to S3 with Wasabi. The IAM in that case is filled with other details - and the bucket is not immutable - but the neccesary steps on Wasabi are (i would say) very detailed descriped.

It’s in german - you could use a translate function, so maybe this article would help you: How to Migrate Backup Data Between Repositories for Veeam Backup for Microsoft 365 – better veeam than sry

I’m not quite sure regards your point #6 with the helper appliance - you will not deploy on Wasabi site, so imo #4 should be OK. 
Maybe Chris has an idea on that point? Or, as he mentioned, ask the Support Team from Veeam or Wasabi. 
 

No other points from me but reach out to support is the best route now as this is only community with limited knowledge and suggestions.

Please feel free to contact me if you need any additional info or help neale@wasabi.com

Glad to hear you resolved the issue 👍

This is correct, Access Control is deprecated. (I was on a tech call with Wasabi recently)

Create a policy, and assign the policy to a user.