simple Minio bucket policy - minio

Question

I am using a docker image of Minio in a Node development environment. The database seed creates a Minio bucket thusly:
await this.s3.createBucket({
Bucket: this.configService.get('S3_BUCKET_NAME'),
ACL: 'public'
}).promise()
This creates the bucket nicely, but the ACL doesn't take at all. I can jump into the Minio browser at http://localhost:9000 and manually set the bucket to public read, but that's obviously kind of cumbersome for a seed.
I've seen a lot of conflicting advice, suggesting things like "Minio doesn't even do ACLs, use a bucket policy," but I can't find a sample policy file anywhere, and the AWS JSON don't seem to work. I would really prefer not to do this via the CLI interface, as I don't want to have to build that into my deployments. Am I missing something?

Answer 1

An example can be found here:
Set Bucket Policy in minio-js (node-js)
var Minio = require('minio')
var s3Client = new Minio.Client({
endPoint: '<host>',
accessKey: 'YOUR-ACCESSKEYID',
secretKey: 'YOUR-SECRETACCESSKEY'
})
// Bucket policy - GET requests on "testbucket" bucket will not need authentication.
var policy = `
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetBucketLocation",
"s3:ListBucket"
],
"Effect": "Allow",
"Principal": {
"AWS": [
"*"
]
},
"Resource": [
"arn:aws:s3:::testbucket"
],
"Sid": ""
},
{
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Principal": {
"AWS": [
"*"
]
},
"Resource": [
"arn:aws:s3:::testbucket/*"
],
"Sid": ""
}
]
}
`
s3Client.setBucketPolicy('testbucket', policy, (err) => {
if (err) throw err
console.log('Set bucket policy')
})

Answer 2

The issue turned out to be that one cannot create the bucket and assign the policy in the same call. There needs to be two calls.
This wound up working:
const S3_BUCKET = 'some_bucket_name'
const policy = JSON.stringify({
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Principal": {
"AWS": [
"*"
]
},
"Resource": [
`arn:aws:s3:::${S3_BUCKET}/*`
],
"Sid": ""
}
]
})
try {
await this.s3.createBucket({ Bucket: S3_BUCKET }).promise()
await this.s3.putBucketPolicy({ Bucket: S3_BUCKET, Policy: policy }).promise()
} catch(error) {
this.logger.error(error, 'create:bucket')
}