Prohibit entry to delicate paperwork in your Amazon Fast data bases for Amazon S3

Organizations that should prohibit entry to delicate paperwork more and more depend on AI-driven search and chat to assist staff discover solutions throughout giant repositories. Coarse-grained permissions that management entry on the data base stage work properly for a lot of groups, however delicate paperwork require extra granular management to limit particular paperwork or folders to approved groups, people, or techniques.

Doc-level entry management record (ACL) help for Amazon Easy Storage Service (Amazon S3) data bases in Amazon Fast offers you that fine-grained management. You prohibit delicate S3 paperwork to solely the customers and teams who ought to see them, on the doc or folder stage. When a consumer asks a query, Fast evaluates their id towards your ACL configuration and solely surfaces content material that they’re approved to view. With these controls in place, you may safely convey your full doc library into Fast whereas assembly your compliance and knowledge governance necessities.

On this submit, we stroll via methods to configure document-level ACLs on your S3 data base in Amazon Fast. You’ll learn to arrange and confirm an ACL configuration that enforces document-level permissions throughout chat and automatic workflows. The submit covers:

• Controlling which S3 buckets customers can entry for data base creation utilizing IAM coverage assignments
• Planning your entry management construction
• Selecting between two ACL configuration strategies (World ACL file and document-level metadata information)
• Organising permissions for customers and teams
• Verifying that your entry controls work appropriately via chat and ACL-aware Flows
• Updating and sustaining your ACL configuration over time

How S3 ACL works in Fast

You should utilize the S3 ACL characteristic in Amazon Fast to connect entry permissions to your paperwork in order that chat responses solely embody content material that you just’re approved to view. You specify who can entry what paperwork utilizing commonplace ALLOW and DENY insurance policies for particular person customers or teams, and Fast enforces these permissions at question time.

There are two methods to configure ACLs, every suited to completely different operational wants:

• World ACL configuration file (similar to ACL.json) – A single centralized file that specifies entry permissions on the folder (prefix) stage. Use this methodology when your group has steady, folder-based permission constructions.
• Doc-level metadata information – Particular person metadata information alongside every doc that comprise per-document entry management entries. Use this methodology when permissions change steadily, as a result of solely affected paperwork must be reindexed relatively than complete folder constructions.

Select your strategy primarily based on how typically permissions change and the way granular you want them to be:

Understanding reindex scope

The reindex scope of your chosen methodology has significant operational implications. With the worldwide ACL strategy, a permission change triggers a full reindex of the affected prefix. In case your group requires frequent permission updates, think about using document-level metadata information as a substitute, the place solely the affected paperwork are reindexed relatively than complete folder constructions.

Deny-by-default habits

Whenever you allow ACLs on an S3 data base in Fast, a doc or prefix not explicitly listed in your ACL configuration is denied by default. This deny-by-default strategy (typically known as “fail closed,” that means the system defaults to denying entry when no express rule exists) signifies that should you configure ACLs, you will need to explicitly grant entry to each prefix or doc you need customers to achieve.

For instance, in case your S3 bucket has three folders (/finance/, /authorized/, and /insurance policies/) and your ACL file solely grants entry to /finance/ and /insurance policies/, the /authorized/ folder and its contents are robotically denied to everybody, even when no DENY rule exists for it.

The implicit deny mannequin utilized by IAM works the identical manner. Fast denies entry until you explicitly grant it. Whenever you configure ACLs, you’ve express management over entry and nothing is inadvertently uncovered.

If a consumer or group has each an ALLOW and a DENY entry for a similar doc or prefix, the DENY at all times takes priority. Because of this you need to use broad ALLOW guidelines for a staff or group after which apply focused DENY entries to limit entry to particular assets, providing you with fine-grained management with out having to restructure your complete ACL configuration.

Stipulations

Earlier than you start, confirm that you’ve the next:

• An AWS account with Amazon Fast enabled. In the event you don’t have a Fast account, consult with Getting began with Amazon Fast.
• An Amazon S3 bucket containing the paperwork you need to index.
• An concept of the way you need to construction your entry management lists. The next sections clarify methods to create these information.
• Customers provisioned in Fast with e-mail addresses that match the identities in your ACL information. For particulars on provisioning customers, see Managing consumer entry in Amazon Fast.
• Fast admin entry for configuring IAM coverage assignments and data base creation.
• Familiarity with IAM ideas and fundamental JSON syntax.
• A take a look at or non-production data base for validating your ACL configuration. Enabling ACLs is a one-way operation that can not be reversed, so confirm your setup earlier than enabling it in manufacturing.

Controlling S3 bucket entry for data base creation

Doc-level ACLs management which paperwork customers can entry inside a data base, however they don’t management who can create data bases within the first place. Preserve this distinction in thoughts. In case your group has S3 buckets that ought to at all times require ACLs (for instance, a bucket containing delicate HR or authorized paperwork), you need to confirm that solely approved directors can create data bases towards these buckets. With out this management, a Fast consumer can create a brand new data base on the identical bucket with out turning on ACLs, bypassing your document-level entry controls completely. This part describes methods to implement these controls.

IAM coverage assignments in Fast allow you to clear up this by limiting which S3 buckets particular customers or teams can entry for data base creation. For instance, you may restrict ACL-sensitive buckets to a small set of trusted directors who will at all times activate ACLs throughout setup, permit broader data base creation for non-sensitive buckets the place ACLs aren’t required, or block sure buckets from data base creation completely by not granting customers entry to them.

Word: IAM insurance policies assigned via Fast take priority over AWS resource-level insurance policies. Verify that your IAM insurance policies meet your entry necessities earlier than assigning them.

This step is elective. Nevertheless, bear in mind that with out IAM coverage assignments limiting data base creation, any Fast consumer with entry to an S3 bucket may create a separate data base on that very same bucket with out enabling ACLs, successfully bypassing your document-level entry controls. Think about whether or not this threat applies to your group earlier than skipping this part.

Step 1: Create an S3 entry coverage in IAM

Create an IAM coverage within the IAM console that specifies which S3 buckets the assigned customers can entry. The next instance coverage grants entry to 2 particular buckets:

{
  "Model": "2012-10-17",
  "Assertion": [
    {
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "arn:aws:s3:::*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:ListBucketVersions",
        "s3:GetBucketLocation"
      ],
      "Useful resource": [
        "arn:aws:s3:::amzn-s3-demo-bucket1",
        "arn:aws:s3:::amzn-s3-demo-bucket2"
      ]
    },
    {
      "Impact": "Permit",
      "Motion": [
        "s3:GetObject",
        "s3:GetObjectVersion"
      ],
      "Useful resource": [
        "arn:aws:s3:::amzn-s3-demo-bucket1/*",
        "arn:aws:s3:::amzn-s3-demo-bucket2/*"
      ]
    }
  ]
}

Change amzn-s3-demo-bucket1 and amzn-s3-demo-bucket2 with the names of the S3 buckets that you just need to grant entry to.

Step 2: Assign the coverage in Fast

After creating the IAM coverage, assign it to Fast customers or teams via the admin console.

To assign the coverage in Fast:

1. Within the Fast admin console, underneath Permissions, select IAM coverage assignments.

2. Select Add new project.

3. Enter a reputation for the project (for instance, s3-kb-restrict).

4. On the Choose an IAM coverage web page, seek for and choose the IAM coverage you created in Step 1. Select Subsequent.

5. On the Assign customers and teams web page, select one of many following:
   1. Choose Assign to customers and teams to use the coverage to present and future customers.
   2. Seek for and choose particular customers or teams to assign the coverage to.
6. Select Subsequent.
7. On the Evaluate and allow adjustments web page, confirm your project particulars and select Save and allow.

Customers who aren’t explicitly granted entry via an IAM coverage project can’t use the restricted S3 buckets to create data bases. A consumer can nonetheless entry a data base shared with them. The restriction solely applies to data base creation. The IAM coverage project offers you a layer of administrative management that enhances the document-level ACLs you configure inside every data base.

For extra particulars, see Prohibit Amazon S3 bucket entry with IAM coverage assignments within the Amazon Fast documentation.

Planning your entry management construction

Earlier than creating your ACL information, decide your entry management construction. Fast enforces the permissions you configure, nevertheless it’s as much as you to determine who ought to have entry to which paperwork and to construct the corresponding ACL information.

Begin by mapping your organizational entry wants. Determine which groups, roles, or people want entry to which doc units. Then select your ACL methodology: a single international ACL file or ACL entries in metadata information on the document-level. Lastly, align your identities. The consumer and group names in your ACL information should match the e-mail addresses and group names of your Fast customers (e-mail matching is case-insensitive, however group names should match precisely). Group membership is managed in your Identification supplier (IdP), similar to IAM Identification Middle, and synced with Fast, not within the ACL information themselves.

The next examples illustrate frequent entry patterns and the way you may construction them.

Possibility 1: Configure entry utilizing a World ACL file

⚠️ Earlier than you start: Enabling document-level ACLs on a data base is a one-way operation and might’t be reversed. If it’s good to take away ACL performance later, you will need to create a brand new data base with out ACLs. Check your ACL configuration on a non-production data base first, as a result of this setting can’t be turned off after it’s enabled.

The worldwide ACL file is a single JSON file that maps S3 prefixes to entry management entries. Add this file to the foundation of your S3 bucket. The file doesn’t must be named acl.json.

World ACL file construction

The file is a JSON array the place every entry specifies an S3 prefix and its related entry management entries.

Every aclEntries merchandise contains:

• Identify – The consumer e-mail deal with or group identify. This should match the id inside Fast precisely. For instance, a consumer’s e-mail or group from IAM Identification Middle.
• Sort – Both USER or GROUP.
• Entry – Both ALLOW or DENY.

Keep in mind, prefixes not listed on this file are denied by default.

Steps to configure

1. Create your acl.json file following the construction proven beforehand.
2. Add the acl.json file to the foundation of your S3 bucket (the identical bucket that incorporates your paperwork).
3. Within the Fast console, navigate to Data.
4. Choose Amazon S3 as a data base and configure your S3 bucket settings.

5. Enter your data base particulars and select Subsequent: Extra settings.

6. Underneath Extra settings, activate the Entry management record (ACL) choice.
7. Within the World ACL file location subject, enter the S3 URI to your acl.json file (for instance, s3://amzn-s3-demo-bucket/acl.json).

8. Select Create.
9. Begin a sync to index your paperwork. Fast applies the ACL guidelines throughout indexing.

After the sync completes, solely paperwork underneath prefixes with express ALLOW entries will probably be listed and obtainable in chat. You may assessment the sync run report back to see which paperwork have been listed and which weren’t listed due to ACL restrictions.

Efficiently added information:

Failed information:

Possibility 2: Configure entry utilizing document-level metadata information

⚠️ Earlier than you start: Enabling document-level ACLs on a data base is a one-way operation and might’t be reversed. If it’s good to take away ACL performance later, you will need to create a brand new data base with out ACLs. Check your ACL configuration on a non-production data base first, as a result of this setting can’t be turned off after it’s enabled.

In the event you want per-document management or need sooner reindexing when permissions change, you need to use document-level metadata information. Every doc in your S3 bucket will get a corresponding metadata JSON file that features entry management entries.

Metadata file construction

Create a .metadata.json file for every doc. The metadata file have to be saved in the identical S3 bucket, in a metadata folder location that you just specify throughout data base setup or as a sidecar subsequent to the precise doc being listed. We clarify the 2 choices within the following part.

The file contains an AccessControlList array. Solely the AccessControlList subject is required for ACL enforcement. The opposite fields (DocumentId, Attributes, Title, ContentType) are elective and used for added metadata enrichment:

{
    "DocumentId": "finance-q3-report",
    "Attributes": {
        "_category": "financial-reports",
        "_created_at": "2025-10-01T00:00:00Z",
        "_source_uri": "s3://amzn-s3-demo-bucket/reviews/q3-report.pdf"
    },
    "AccessControlList": [
        {
            "Name": "finance-team",
            "Type": "GROUP",
            "Access": "ALLOW"
        },
        {
            "Name": "contractor@example.com",
            "Type": "USER",
            "Access": "DENY"
        }
    ],
    "Title": "Q3 Monetary Report",
    "ContentType": "PDF"
}

The AccessControlList entries observe the identical format as the worldwide ACL file. Every entry has a Identify, Sort (USER or GROUP), and Entry (ALLOW or DENY).

Paperwork with out a metadata file (or with a metadata file that doesn’t embody an AccessControlList) are denied by default when ACLs are turned on.

Metadata file identify and placement

For the data base to search out the right metadata file, the doc’s S3 secret’s appended to the metadata folder location after which suffixed with .metadata.json to construct the metadata file’s Amazon S3 path. For instance, if the file S3 secret’s recipe.pdf, the metadata file S3 key can be recipe.pdf.metadata.json.

There are two choices for the place to position your metadata information. You may put them in a devoted listing (similar to s3://amzn-s3-demo-bucket/metadata) or in the identical folder because the referenced file.

Right here’s an instance of the information collectively in the identical folder:

One other instance with a devoted “metadata” folder:

Steps to configure

1. Create a .metadata.json file for every doc that you just need to index, together with the AccessControlList subject.
2. Add the metadata information to your S3 bucket in both a devoted metadata folder or in the identical folder as every matching S3 file.
3. Within the Fast console, navigate to Data.
4. Choose Amazon S3 as a brand new data base.
5. Underneath Extra settings, activate the entry management record (ACL) choice.
6. For metadata file location, select one of many following choices:
   1. Identical folder choice: Depart the metadata folder location clean.

• 1. Devoted folder choice: Within the Metadata folder location subject, enter the S3 URI to your metadata folder (for instance, s3://amzn-s3-demo-bucket/metadata/).

1. Select Create.
2. Begin a sync. Fast reads the ACL entries from every metadata file and enforces them at question time.

Verifying your configuration

After your data base sync completes, you may confirm that ACLs are working appropriately via chat and flows.

Chat

To confirm ACLs in chat:

1. Open a chat in Fast and hook up with your ACL-enabled data base.
2. Disable net search on the backside of your chat session to isolate outcomes to your data base.
3. Ask a query a couple of doc that you’ve entry to. It is best to obtain a related response.

4. Ask a query a couple of doc that you just don’t have entry to. Fast shouldn’t floor content material from that doc.

The ACL verification confirms that Fast is filtering responses primarily based in your id and ACL configuration.

Flows

With Fast Flows and S3 ACLs, you may construct clever, permission-aware automation pipelines that respect knowledge governance whereas delivering insights at scale.

The next instance explores a movement idea: ACL-aware flows for govt summaries.

The movement incorporates the next steps:

1. Set off and consumer context: A consumer submits a subject utilizing the Chat or Movement console. The movement captures their id for entry analysis.
2. S3 ACL analysis: The movement checks ACL configurations to find out which paperwork you may entry, imposing knowledge governance on the automation layer.
3. Inside abstract era: If approved paperwork exist, the movement retrieves them and produces an govt abstract from inner sources.
4. Net search fallback: When no inner sources are accessible, the movement robotically searches the online. Exterior summaries are clearly labeled for transparency. That is an elective step of the Movement.

You may additional broaden this use case by passing the abstract to a downstream step that creates a structured slide deck for management briefings, or by including an e-mail step to ship summaries to customers or distribution lists on a recurring schedule.

Updating ACLs after preliminary setup

When your group evolves (new hires, staff adjustments, function transitions), replace your entry management configuration accordingly. Fast doesn’t monitor your ACL information for adjustments in actual time. Up to date permissions take impact on the subsequent data base sync, which runs every day by default. For time-sensitive adjustments similar to revoking entry, set off a guide sync instantly after updating your ACL information. To replace permissions:

1. Replace your ACL information in S3. Modify your international ACL file or the related document-level metadata information to mirror the brand new permissions (including customers, eradicating entry, altering group memberships, and so forth).
2. Resync your data base. After importing the up to date information to S3, set off a brand new sync in your data base from the Fast console. Fast re-evaluates the ACL entries in the course of the sync and updates the index accordingly.

Till the sync completes, the earlier permissions stay in impact.

The reindex scope depends upon which configuration methodology you employ:

• World ACL file. Your entire affected prefix is reindexed.
• Doc-level metadata. Solely the paperwork whose metadata information modified are reindexed.

In the event you anticipate frequent permission adjustments, document-level metadata information offer you sooner turnaround on entry updates.

Securing your ACL information

Prohibit s3:PutObject permissions in your ACL and metadata information to a restricted set of directors. Anybody who can modify these information can grant themselves entry to any doc, so deal with write entry to ACL information as a privileged operation. Allow S3 versioning in your ACL information to keep up an audit path of permission adjustments. For document-level metadata information, assign possession to staff members conversant in the sensitivity of every doc set, similar to knowledge homeowners or safety leads, in order that permission selections keep aligned with enterprise context.

Monitoring and auditing ACL exercise

For a safety characteristic like document-level ACLs, visibility into configuration adjustments and entry patterns is crucial. Amazon Fast gives a number of mechanisms that can assist you monitor and audit your ACL-enabled data bases.

All data base create and replace actions are logged in AWS CloudTrail, together with whether or not ACLs are enabled on the data base. This offers directors an audit path of who configured ACLs and when, serving to you monitor adjustments to your entry management setup and examine any surprising modifications.

Amazon Fast additionally gives a characteristic for monitoring the dimensions of your data bases, which may help you monitor development and detect surprising adjustments in listed content material. For extra particulars, see monitor index storage utilization within the Fast documentation.

Limitations and concerns

Earlier than you activate ACLs in your S3 data base, concentrate on the next:

• ACLs can’t be disabled after they’re enabled. Turning on document-level ACLs on a data base is a one-way operation. If it’s good to take away ACL performance later, you will need to create a brand new data base with out ACLs.
• Consumer id matching is email-based. The Identify subject in your ACL entries should precisely match the e-mail deal with related to the consumer’s Fast id. If a consumer’s e-mail adjustments, replace your ACL information and resync.

For added limitations, see S3 knowledge supply connector limitations and Data base ACL limitations within the Amazon Fast documentation.

Clear up assets

In the event you created assets whereas following this submit and now not want them, take the next steps to keep away from ongoing prices:

1. Delete the data base. Within the Fast console, navigate to Data, choose the data base that you just created, and select Delete.
2. Take away ACL and metadata information. Delete the worldwide ACL file and document-level .metadata.json information out of your S3 bucket in the event that they have been created for testing functions.
3. Take away IAM insurance policies. In the event you created an IAM coverage for S3 bucket entry restrictions, first take away the IAM coverage project within the Fast admin console, then delete the IAM coverage itself within the IAM console.

Conclusion

Doc-level ACLs for Amazon S3 data bases in Amazon Fast offer you granular management over who can entry particular paperwork in your data base. On this submit, you configured IAM coverage assignments to manage data base creation, deliberate an entry management construction, arrange each World ACL information and document-level metadata information, verified your configuration via chat and Flows, and discovered methods to troubleshoot frequent points.

With these controls in place, you may confidently broaden the content material in your data bases, understanding that every consumer solely sees the paperwork and knowledge they’re approved to entry. This helps your group get extra worth from Fast whereas assembly safety, compliance, and knowledge governance necessities. Fast Flows extends these controls into automated workflows, checking consumer entry at runtime and producing outputs from solely the paperwork a consumer is permitted to see. With document-level ACLs, your group can confidently use AI to unlock the worth of delicate knowledge, securely.

Subsequent steps

To proceed constructing on what you’ve discovered:

• Evaluate the Amazon S3 connector documentation for detailed configuration reference.
• Learn the ACL greatest practices information for suggestions on structuring your entry controls at scale.
• Attempt organising ACLs on a take a look at data base with pattern paperwork earlier than rolling out to manufacturing. Begin with a small set of paperwork and some take a look at customers, then broaden when you’ve verified the configuration works as anticipated.

To be taught extra about Amazon Fast, go to the Fast product web page, discover the safety features in Fast, and be a part of the Fast Group to ask questions and share your experiences.

Concerning the authors