AWS Storage Gateway User Guide
Deleting a File Share
Using a File Share for Cross-Account Access
Cross-account access is when an AWS account and users for that account are granted access to resources
that belong to another AWS account. With file gateways, you can use a file share in one AWS account to
access objects in an Amazon S3 bucket that belongs to a different AWS account.
To use a file share owned by one AWS account to access an S3 bucket in a different AWS
account
1. Make sure that the S3 bucket owner has granted your AWS account access to the S3 bucket that you
need to access and the objects in that bucket. For information about how to grant this access, see
Example 2: Bucket Owner Granting Cross-Account Bucket Permissions in the Amazon Simple Storage
Service Developer Guide. For a list of the required permissions, see Granting Access to an Amazon S3
Bucket (p. 144).
2. Make sure that the IAM role that your file share uses to access the S3 bucket includes permissions for
operations such as s3:GetObjectAcl and s3:PutObjectAcl. In addition, make sure that the IAM
role includes a trust policy that allows your account to assume that IAM role. For an example of such
a trust policy, see Granting Access to an Amazon S3 Bucket (p. 144).
If your file share uses an existing role to access the S3 bucket, you should include permissions for
s3:GetObjectAcl and s3:PutObjectAcl operations. The role also needs a trust policy that
allows your account to assume this role. For an example of such a trust policy, see Granting Access to
an Amazon S3 Bucket (p. 144).
3. Open the AWS Storage Gateway console at https://console.amazonaws.cn/storagegateway/home.
4. Choose Give bucket owner full control in the Object metadata settings in the Configure file share
setting dialog box.
When you have created or updated your file share for cross-account access and mounted the file share
on-premises, we highly recommend that you test your setup. You can do this by listing directory contents
or writing test files and making sure the files show up as objects in the S3 bucket.
Important
Make sure to set up the policies correctly to grant cross-account access to the account used
by your file share. If you don't, updates to files through your on-premises applications don't
propagate to the Amazon S3 bucket that you're working with.
Resources
For additional information about access policies and access control lists, see the following:
Guidelines for Using the Available Access Policy Options in the Amazon Simple Storage Service Developer
Guide
Access Control List (ACL) Overview in the Amazon Simple Storage Service Developer Guide
Deleting a File Share
If you no longer need a file share, you can delete it from the AWS Storage Gateway Management
Console. When you delete a file share, the gateway is detached from the Amazon S3 bucket that the file
share maps to. However, the S3 bucket and its contents aren't deleted.
If your gateway is uploading data to a S3 bucket when you delete a file share, the delete process
doesn't complete until all the data is uploaded. The file share has the DELETING status until the data is
completely uploaded.
API Version 2013-06-30
146
To Next Page
Loading...