DEV Community: El Morjani Mohamed

How to Apply S3 Bucket Policies Using AWS CLI

El Morjani Mohamed — Tue, 01 Oct 2024 10:24:16 +0000

Managing access control for your Amazon S3 buckets is essential for maintaining security in your AWS environment. In this article, I'll guide you through applying two different S3 bucket policies using the AWS CLI. One policy will allow access from a specific IP address, and the other will restrict access to specific objects (like images) from a designated domain.

Step 1: Create and Apply the `policy.json` File

The first policy we'll create allows access to your S3 bucket only from a specific IP address. Below is an example of a policy you can use.

`policy.json`

{
    "Version": "2012-10-17",
    "Id": "Allow specific IP",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::devops22-cli-bucket/*"
            ],
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "102.51.8.73"
                }
            }
        }
    ]
}

This policy grants permission to all S3 actions ("s3:*") on the devops22-cli-bucket for the IP address 102.51.8.73.

Apply the `policy.json` Using AWS CLI

To apply this policy to your S3 bucket, execute the following command in your terminal:

aws s3api put-bucket-policy --bucket devops22-cli-bucket --policy file://policy.json

This command applies the policy defined in policy.json to the devops22-cli-bucket.

Step 2: Create and Apply the `domain_policy.json` File

Next, let's create a policy that limits access to .jpg images in the S3 bucket, allowing requests only from a specific domain. This is particularly useful if you want to limit access to certain resources based on the referring domain.

`domain_policy.json`

{
  "Version": "2012-10-17",
  "Id": "Allow cloudntaivebasecamp.com to access the images",
  "Statement": [
    {
      "Sid": "Allow only GET requests originating from specific domain",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::devops22-cli-bucket/*.jpg",
      "Condition": {
        "StringLike": { "aws:Referer": ["https://example.com/*"] }
      }
    }
  ]
}

This policy allows GET requests for .jpg files within the devops22-cli-bucket only from the domain example.com.

Apply the `domain_policy.json` Using AWS CLI

To apply this domain-based policy, use the following command:

aws s3api put-bucket-policy --bucket devops22-cli-bucket --policy file://domain_policy.json

Conclusion

By using the AWS CLI, you can easily apply bucket policies that control access to your S3 resources. In this article, we covered two examples:

A policy allowing access from a specific IP address.
A policy restricting access to certain resources from a specific domain.

These are just two examples of how you can fine-tune your access control policies using S3's flexible policy system. Feel free to adapt these examples to meet the security requirements of your own environment.

Happy coding! 🚀

🚀 Mastering AWS S3 with the CLI: A Simple Guide to Creating & Managing Buckets 💻

El Morjani Mohamed — Sun, 29 Sep 2024 20:49:14 +0000

As developers, we often find ourselves managing cloud storage. AWS S3 is a popular choice due to its flexibility, scalability, and security. Here's a quick breakdown of how to create, configure, and manage an S3 bucket using AWS CLI! 👇

🛠️ Steps to Create and Manage a Bucket:

Create a new S3 bucket in your desired region:

   aws s3api create-bucket --bucket devops22-cli-bucket --region eu-north-1 --create-bucket-configuration LocationConstraint=eu-north-1

List your buckets to ensure it's created successfully:

   aws s3 ls

Secure your bucket by blocking all public access:

   aws s3api put-public-access-block --bucket devops22-cli-bucket --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

Upload files into your S3 bucket (like images or documents):

   aws s3api put-object --bucket devops22-cli-bucket --content-type image/jpeg --key s3Devops22.jpg --body /path/to/your/image.jpg

Manage permissions to control public or private access to your files. For instance, making an object publicly readable:

   aws s3api put-object-acl --bucket devops22-cli-bucket --key s3Devops22.jpg --acl public-read

Delete files or buckets when no longer needed:

   aws s3api delete-object --bucket devops22-cli-bucket --key s3Devops22.jpg
   aws s3api delete-bucket --bucket devops22-cli-bucket --region eu-north-1

💡 Why use AWS CLI for S3?

The AWS CLI provides a fast, scriptable interface for managing your resources efficiently—whether you're creating, securing, or optimizing your buckets. It's ideal for developers who want control and automation in their cloud workflows.

Let’s keep sharing tips and improving our DevOps skills! 🔥

𝗟𝗮𝗿𝗮𝘃𝗲𝗹 𝗧𝗶𝗽💡: 𝗚𝗲𝗻𝗲𝗿𝗮𝘁𝗲 𝗙𝗮𝗸𝗲 𝗨𝘀𝗲𝗿 𝗔𝗴𝗲𝗻𝘁𝘀

El Morjani Mohamed — Wed, 24 Jul 2024 08:01:03 +0000

Did you know you can generate fake user agents for your tests using Laravel? Since Laravel leverages FakerPHP under the hood, this feature is both powerful and easy to implement. 🚀

In this snippet, we're using FakerPHP to generate various fake user agents for different browsers. This can be particularly useful when writing tests that need to simulate requests from different browsers and devices.

By incorporating fake user agents into your testing strategy, you can simulate diverse browsing environments and improve the robustness of your applications.

Happy coding! 💻

🚀 Laravel Tip💡: Extract Validated Input Elegantly

El Morjani Mohamed — Sun, 21 Jul 2024 18:26:54 +0000

As developers, we often need to extract only a few items from a validated request. Instead of manually unsetting or filtering, Laravel provides a clean and efficient way to do this using the safe() method. Here’s how:

// Extract only specific fields
$validated = $request->safe()->only(['name', 'email']);

// Extract all fields except specified ones
$validated = $request->safe()->except(['name', 'email']);

// Extract all validated input
$validated = $request->safe()->all();

Using safe() makes your code cleaner and ensures you're only working with validated data, enhancing both security and code clarity.

Laravel Tip💡: Extract Validated Input Elegantly

El Morjani Mohamed — Sun, 21 Jul 2024 18:17:53 +0000

We often redirect our users to specific routes using the "redirect()" method. Did you know there is a shorter and more expressive method called "to_route"? 🚀

<?php

// 🚀 Instead of this
return redirect()->route('profile');

// ✨ You can do this
return to_route('profile');
?>

Both snippets achieve the same result, but to_route makes your code cleaner and more readable. Small changes can have a big impact! 😊

Revamp Your GitHub: Elevate Your README!

El Morjani Mohamed — Thu, 09 May 2024 10:46:23 +0000

Greetings everyone,

I hope this message finds you well. Today, I'd like to delve into the realm of GitHub. As I embark on my journey to further my studies as a developer, I recognize the significance of maintaining an updated and polished GitHub profile.

While I created my GitHub account a year ago, I admit that I initially underestimated the importance of maintaining it. However, this year signifies a pivotal moment as I dedicate myself to consistently updating it with my ongoing projects and endeavors.

In my efforts to revamp my profile, I've taken the initiative to refine my bio, update my README, and ensure that my projects are up-to-date. My aim is for my GitHub profile to serve as a true reflection of my identity and aspirations.

As I undergo these changes, I find myself pondering the question: "What constitutes best practices on GitHub? What attributes are sought after in the market?" This contemplation has prompted me to reach out to you all for insights. I invite you to share your tips and recommendations in the comments below.

Furthermore, if you're inclined, I would greatly appreciate any feedback on how I can enhance my profile. Please feel free to drop your GitHub profiles in the comments so that we can all engage, inspire, and connect.

Thank you for your time and contributions.

Warm regards, Mohamed EL Morjani