Table of Contents

S3 Tables Security

Permission Model

Default Permission Behavior
Policy Structure

Supported Actions

Table Bucket Operations
Namespace Operations
Table Operations

Example Policies

1. Read-Only Access
2. Admin Access for Specific Namespace
3. Deny Deletion

S3 Tables Security

SeaweedFS S3 Tables implementation supports fine-grained access control using IAM-style policies. These policies can be attached to Table Buckets to control access to namespaces and tables.

Permission Model

Permissions are defined using JSON policy documents similar to AWS IAM. Policies are attached to the Table Bucket using the PutTableBucketPolicy API.

Default Permission Behavior

If no policy is attached to a Table Bucket:

Zero Configuration: Access is Allowed by default (simplifies development).
IAM Configured: Access is Denied by default (security best practice).

Policy Structure

A policy document consists of a list of statements:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3tables:CreateTable",
      "Resource": "*"
    }
  ]
}

Effect: Allow or Deny. Deny always takes precedence.
Principal: The user or role (e.g., *, arn:aws:iam::123456789012:user/admin).
Action: The API operation to allow/deny (supports wildcards).
Resource: The resource ARN (supports wildcards).
Condition: (Optional) extra conditions for the rule.

Supported Actions

The following actions are supported in policies. Actions can be specified with the s3tables: prefix or without it (for some contexts).

Table Bucket Operations

s3tables:CreateTableBucket
s3tables:DeleteTableBucket
s3tables:GetTableBucket
s3tables:ListTableBuckets
s3tables:PutTableBucketPolicy
s3tables:GetTableBucketPolicy
s3tables:DeleteTableBucketPolicy

Namespace Operations

s3tables:CreateNamespace
s3tables:DeleteNamespace
s3tables:GetNamespace
s3tables:ListNamespaces

Table Operations

s3tables:CreateTable
s3tables:DeleteTable
s3tables:GetTable
s3tables:ListTables
s3tables:PutTablePolicy
s3tables:GetTablePolicy
s3tables:DeleteTablePolicy

Example Policies

1. Read-Only Access

Allow listing and getting tables, but no modifications.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "s3tables:Get*",
        "s3tables:List*"
      ],
      "Resource": "*"
    }
  ]
}

2. Admin Access for Specific Namespace

Allow full access only to tables within the finance namespace.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "arn:aws:iam::123456789012:user/finance-admin",
      "Action": "s3tables:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "s3tables:namespace": "finance"
        }
      }
    }
  ]
}

3. Deny Deletion

Allow everything except deleting tables.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3tables:*",
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3tables:DeleteTable",
      "Resource": "*"
    }
  ]
}

Introduction

API

Configuration

Filer

Filer Stores

Management

Advanced Filer Configurations

FUSE Mount

WebDAV

SFTP Server

Cloud Drive

AWS S3 API

S3 Table Bucket

Iceberg Integrations

S3 Authentication & IAM

S3 Configuration - Start Here
S3 Credentials (-s3.config)
OIDC Integration (-s3.iam.config)
Kubernetes ServiceAccount Authentication (IRSA-style)
S3 Policy Variables
S3 Policy Conditions
S3 Bucket Policies
Amazon IAM API
AWS IAM CLI
weed shell - Shell IAM Commands

Server-Side Encryption

S3 Client Tools

Machine Learning

HDFS

Replication and Backup

Async Replication to another Filer [Deprecated]
Async Backup
Async Filer Metadata Backup
Async Replication to Cloud [Deprecated]
Kubernetes Backups and Recovery with K8up