AWS S3: Least Privilege Access Setup

When connecting your AWS S3 buckets to Cloney for data migration, it's essential to follow the principle of least privilege. This guide will walk you through creating IAM credentials with only the permissions necessary for Cloney to read from or write to your S3 buckets, minimizing security risks.

1. Sign in to the AWS Management Console
2. Navigate to IAM (Identity and Access Management)
3. In the left sidebar, click on Policies
4. Click the Create policy button

If your S3 bucket will be used as a source for migration (data will be read from it), use this policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CloneySourceAccess",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::YOUR-BUCKET-NAME",
                "arn:aws:s3:::YOUR-BUCKET-NAME/*"
            ]
        }
    ]
}

If your S3 bucket will be used as a destination for migration (data will be written to it), use this policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CloneyDestinationAccess",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::YOUR-BUCKET-NAME",
                "arn:aws:s3:::YOUR-BUCKET-NAME/*"
            ]
        }
    ]
}

1. In the IAM console, click on Users in the left sidebar
2. Click Create user
3. Enter a descriptive username (e.g., cloney-migration-user)
4. Click Next
5. Select Attach policies directly
6. Search for and select the policy you created in the previous step
7. Click Next, then Create user

1. Click on the user you just created
2. Go to the Security credentials tab
3. Under Access keys, click Create access key
4. Select Third-party service as the use case
5. Acknowledge the recommendation and click Next
6. Click Create access key
7. Important: Copy both the Access key ID and Secret access key. The secret key will only be shown once.