1 Answer
- Newest
- Most votes
- Most comments
0
You want to prevent FSx Lustre DRA to write to the linked S3 bucket. In that case, you can remove the link to the bucket. https://docs.aws.amazon.com/fsx/latest/LustreGuide/delete-linked-dra.html
I won't suggest updating the bucket policy to prevent it. It will work but FSx will keep on trying to write to it which is unnecessary.
Also, based on your updated question, here's a sample bucket policy that you might create when setting up the FSx Lustre. You can remove the permissions that you do not need. In your case, you might remove s3:PutObject and s3:DeleteObject permissions.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": [
~~ "s3:AbortMultipartUpload",~~
~~ "s3:DeleteObject",~~
~~"s3:PutObject",~~
"s3:GetObject",
"s3:GetBucketAcl",
"s3:GetBucketNotification",
"s3:ListBucket",
~~"s3:PutBucketNotification"~~
],
"Resource": [
"arn:aws:s3:::bucket_name",
"arn:aws:s3:::bucket_name/*"
],
"Condition": {
"StringLike": {
"aws:PrincipalArn": [
"arn:aws:iam::file_system_account_ID:role/aws-service-role/s3.data-source.lustre.fsx.amazonaws.com/AWSServiceRoleForFSxS3Access_fs-*"
}
}
}
]
}
answered 2 months ago
Relevant content
- asked 2 months ago
- asked 3 years ago
- asked a year ago
- AWS OFFICIALUpdated a year ago
I do not want to delete the DRA because I would still like to be able to read from the S3 bucket via the DRA. I have updated the question.
Thanks for the update. It seems that based on the article provided (https://docs.aws.amazon.com/fsx/latest/LustreGuide/s3-validation-error.html), DRA creation would have to be done before this bucket policy is applied, otherwise DRA creation would fail.