Prohibit entry to delicate paperwork in your Amazon Fast information bases for Amazon S3

Organizations that should limit entry to delicate paperwork more and more depend on AI-driven search and chat to assist workers discover solutions throughout massive repositories. Coarse-grained permissions that management entry on the information base stage work properly for a lot of groups, however delicate paperwork require extra granular management to limit particular paperwork or folders to licensed groups, people, or programs.

Doc-level entry management record (ACL) assist for Amazon Easy Storage Service (Amazon S3) information bases in Amazon Fast offers you that fine-grained management. You limit delicate S3 paperwork to solely the customers and teams who ought to see them, on the doc or folder stage. When a person asks a query, Fast evaluates their id in opposition to your ACL configuration and solely surfaces content material that they’re licensed to view. With these controls in place, you’ll be able to safely convey your full doc library into Fast whereas assembly your compliance and information governance necessities.

On this put up, we stroll via how you can configure document-level ACLs in your S3 information base in Amazon Fast. You’ll discover ways to arrange and confirm an ACL configuration that enforces document-level permissions throughout chat and automatic workflows. The put up covers:

• Controlling which S3 buckets customers can entry for information base creation utilizing IAM coverage assignments
• Planning your entry management construction
• Selecting between two ACL configuration strategies (World ACL file and document-level metadata information)
• Establishing permissions for customers and teams
• Verifying that your entry controls work appropriately via chat and ACL-aware Flows
• Updating and sustaining your ACL configuration over time

How S3 ACL works in Fast

You need to use the S3 ACL function in Amazon Fast to connect entry permissions to your paperwork in order that chat responses solely embrace content material that you just’re licensed to view. You specify who can entry what paperwork utilizing commonplace ALLOW and DENY insurance policies for particular person customers or teams, and Fast enforces these permissions at question time.

There are two methods to configure ACLs, every suited to completely different operational wants:

• World ACL configuration file (similar to ACL.json) – A single centralized file that specifies entry permissions on the folder (prefix) stage. Use this methodology when your group has steady, folder-based permission buildings.
• Doc-level metadata information – Particular person metadata information alongside every doc that include per-document entry management entries. Use this methodology when permissions change regularly, as a result of solely affected paperwork should be reindexed somewhat than whole folder buildings.

Select your strategy primarily based on how typically permissions change and the way granular you want them to be:

Understanding reindex scope

The reindex scope of your chosen methodology has significant operational implications. With the worldwide ACL strategy, a permission change triggers a full reindex of the affected prefix. In case your group requires frequent permission updates, think about using document-level metadata information as an alternative, the place solely the affected paperwork are reindexed somewhat than whole folder buildings.

Deny-by-default conduct

While you allow ACLs on an S3 information base in Fast, a doc or prefix not explicitly listed in your ACL configuration is denied by default. This deny-by-default strategy (typically referred to as “fail closed,” which means the system defaults to denying entry when no express rule exists) signifies that when you configure ACLs, it’s essential to explicitly grant entry to each prefix or doc you need customers to succeed in.

For instance, in case your S3 bucket has three folders (/finance/, /authorized/, and /insurance policies/) and your ACL file solely grants entry to /finance/ and /insurance policies/, the /authorized/ folder and its contents are robotically denied to everybody, even when no DENY rule exists for it.

The implicit deny mannequin utilized by IAM works the identical manner. Fast denies entry until you explicitly grant it. While you configure ACLs, you have got express management over entry and nothing is inadvertently uncovered.

If a person or group has each an ALLOW and a DENY entry for a similar doc or prefix, the DENY all the time takes priority. Because of this you should utilize broad ALLOW guidelines for a crew or group after which apply focused DENY entries to limit entry to particular sources, supplying you with fine-grained management with out having to restructure your whole ACL configuration.

Stipulations

Earlier than you start, confirm that you’ve got the next:

• An AWS account with Amazon Fast enabled. When you don’t have a Fast account, check with Getting began with Amazon Fast.
• An Amazon S3 bucket containing the paperwork you wish to index.
• An thought of the way you wish to construction your entry management lists. The next sections clarify how you can create these information.
• Customers provisioned in Fast with electronic mail addresses that match the identities in your ACL information. For particulars on provisioning customers, see Managing person entry in Amazon Fast.
• Fast admin entry for configuring IAM coverage assignments and information base creation.
• Familiarity with IAM ideas and fundamental JSON syntax.
• A check or non-production information base for validating your ACL configuration. Enabling ACLs is a one-way operation that can not be reversed, so confirm your setup earlier than enabling it in manufacturing.

Controlling S3 bucket entry for information base creation

Doc-level ACLs management which paperwork customers can entry inside a information base, however they don’t management who can create information bases within the first place. Preserve this distinction in thoughts. In case your group has S3 buckets that ought to all the time require ACLs (for instance, a bucket containing delicate HR or authorized paperwork), you wish to confirm that solely licensed directors can create information bases in opposition to these buckets. With out this management, a Fast person can create a brand new information base on the identical bucket with out turning on ACLs, bypassing your document-level entry controls totally. This part describes how you can implement these controls.

IAM coverage assignments in Fast allow you to remedy this by proscribing which S3 buckets particular customers or teams can entry for information base creation. For instance, you’ll be able to restrict ACL-sensitive buckets to a small set of trusted directors who will all the time activate ACLs throughout setup, enable broader information base creation for non-sensitive buckets the place ACLs aren’t required, or block sure buckets from information base creation totally by not granting customers entry to them.

Notice: IAM insurance policies assigned via Fast take priority over AWS resource-level insurance policies. Verify that your IAM insurance policies meet your entry necessities earlier than assigning them.

This step is non-obligatory. Nevertheless, bear in mind that with out IAM coverage assignments proscribing information base creation, any Fast person with entry to an S3 bucket may create a separate information base on that very same bucket with out enabling ACLs, successfully bypassing your document-level entry controls. Think about whether or not this threat applies to your group earlier than skipping this part.

Step 1: Create an S3 entry coverage in IAM

Create an IAM coverage within the IAM console that specifies which S3 buckets the assigned customers can entry. The next instance coverage grants entry to 2 particular buckets:

{
  "Model": "2012-10-17",
  "Assertion": [
    {
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "arn:aws:s3:::*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:ListBucketVersions",
        "s3:GetBucketLocation"
      ],
      "Useful resource": [
        "arn:aws:s3:::amzn-s3-demo-bucket1",
        "arn:aws:s3:::amzn-s3-demo-bucket2"
      ]
    },
    {
      "Impact": "Enable",
      "Motion": [
        "s3:GetObject",
        "s3:GetObjectVersion"
      ],
      "Useful resource": [
        "arn:aws:s3:::amzn-s3-demo-bucket1/*",
        "arn:aws:s3:::amzn-s3-demo-bucket2/*"
      ]
    }
  ]
}

Change amzn-s3-demo-bucket1 and amzn-s3-demo-bucket2 with the names of the S3 buckets that you just wish to grant entry to.

Step 2: Assign the coverage in Fast

After creating the IAM coverage, assign it to Fast customers or teams via the admin console.

To assign the coverage in Fast:

1. Within the Fast admin console, beneath Permissions, select IAM coverage assignments.

2. Select Add new project.

3. Enter a reputation for the project (for instance, s3-kb-restrict).

4. On the Choose an IAM coverage web page, seek for and choose the IAM coverage you created in Step 1. Select Subsequent.

5. On the Assign customers and teams web page, select one of many following:
   1. Choose Assign to customers and teams to use the coverage to present and future customers.
   2. Seek for and choose particular customers or teams to assign the coverage to.
6. Select Subsequent.
7. On the Assessment and allow adjustments web page, confirm your project particulars and select Save and allow.

Customers who aren’t explicitly granted entry via an IAM coverage project can’t use the restricted S3 buckets to create information bases. A person can nonetheless entry a information base shared with them. The restriction solely applies to information base creation. The IAM coverage project offers you a layer of administrative management that enhances the document-level ACLs you configure inside every information base.

For extra particulars, see Prohibit Amazon S3 bucket entry with IAM coverage assignments within the Amazon Fast documentation.

Planning your entry management construction

Earlier than creating your ACL information, decide your entry management construction. Fast enforces the permissions you configure, nevertheless it’s as much as you to determine who ought to have entry to which paperwork and to construct the corresponding ACL information.

Begin by mapping your organizational entry wants. Establish which groups, roles, or people want entry to which doc units. Then select your ACL methodology: a single international ACL file or ACL entries in metadata information on the document-level. Lastly, align your identities. The person and group names in your ACL information should match the e-mail addresses and group names of your Fast customers (electronic mail matching is case-insensitive, however group names should match precisely). Group membership is managed in your Identification supplier (IdP), similar to IAM Identification Middle, and synced with Fast, not within the ACL information themselves.

The next examples illustrate frequent entry patterns and the way you would possibly construction them.

Choice 1: Configure entry utilizing a World ACL file

⚠️ Earlier than you start: Enabling document-level ACLs on a information base is a one-way operation and may’t be reversed. If you must take away ACL performance later, it’s essential to create a brand new information base with out ACLs. Check your ACL configuration on a non-production information base first, as a result of this setting can’t be turned off after it’s enabled.

The worldwide ACL file is a single JSON file that maps S3 prefixes to entry management entries. Add this file to the basis of your S3 bucket. The file doesn’t should be named acl.json.

World ACL file construction

The file is a JSON array the place every entry specifies an S3 prefix and its related entry management entries.

Every aclEntries merchandise contains:

• Title – The person electronic mail handle or group title. This should match the id inside Fast precisely. For instance, a person’s electronic mail or group from IAM Identification Middle.
• Sort – Both USER or GROUP.
• Entry – Both ALLOW or DENY.

Keep in mind, prefixes not listed on this file are denied by default.

Steps to configure

1. Create your acl.json file following the construction proven beforehand.
2. Add the acl.json file to the basis of your S3 bucket (the identical bucket that comprises your paperwork).
3. Within the Fast console, navigate to Data.
4. Choose Amazon S3 as a information base and configure your S3 bucket settings.

5. Enter your information base particulars and select Subsequent: Extra settings.

6. Beneath Extra settings, activate the Entry management record (ACL) choice.
7. Within the World ACL file location area, enter the S3 URI to your acl.json file (for instance, s3://amzn-s3-demo-bucket/acl.json).

8. Select Create.
9. Begin a sync to index your paperwork. Fast applies the ACL guidelines throughout indexing.

After the sync completes, solely paperwork beneath prefixes with express ALLOW entries might be listed and out there in chat. You’ll be able to assessment the sync run report back to see which paperwork had been listed and which weren’t listed due to ACL restrictions.

Efficiently added information:

Failed information:

Choice 2: Configure entry utilizing document-level metadata information

⚠️ Earlier than you start: Enabling document-level ACLs on a information base is a one-way operation and may’t be reversed. If you must take away ACL performance later, it’s essential to create a brand new information base with out ACLs. Check your ACL configuration on a non-production information base first, as a result of this setting can’t be turned off after it’s enabled.

When you want per-document management or need sooner reindexing when permissions change, you should utilize document-level metadata information. Every doc in your S3 bucket will get a corresponding metadata JSON file that features entry management entries.

Metadata file construction

Create a .metadata.json file for every doc. The metadata file should be saved in the identical S3 bucket, in a metadata folder location that you just specify throughout information base setup or as a sidecar subsequent to the precise doc being listed. We clarify the 2 choices within the following part.

The file contains an AccessControlList array. Solely the AccessControlList area is required for ACL enforcement. The opposite fields (DocumentId, Attributes, Title, ContentType) are non-obligatory and used for extra metadata enrichment:

{
    "DocumentId": "finance-q3-report",
    "Attributes": {
        "_category": "financial-reports",
        "_created_at": "2025-10-01T00:00:00Z",
        "_source_uri": "s3://amzn-s3-demo-bucket/stories/q3-report.pdf"
    },
    "AccessControlList": [
        {
            "Name": "finance-team",
            "Type": "GROUP",
            "Access": "ALLOW"
        },
        {
            "Name": "contractor@example.com",
            "Type": "USER",
            "Access": "DENY"
        }
    ],
    "Title": "Q3 Monetary Report",
    "ContentType": "PDF"
}

The AccessControlList entries observe the identical format as the worldwide ACL file. Every entry has a Title, Sort (USER or GROUP), and Entry (ALLOW or DENY).

Paperwork with no metadata file (or with a metadata file that doesn’t embrace an AccessControlList) are denied by default when ACLs are turned on.

Metadata file title and placement

For the information base to seek out the proper metadata file, the doc’s S3 secret is appended to the metadata folder location after which suffixed with .metadata.json to construct the metadata file’s Amazon S3 path. For instance, if the file S3 secret is recipe.pdf, the metadata file S3 key could be recipe.pdf.metadata.json.

There are two choices for the place to put your metadata information. You’ll be able to put them in a devoted listing (similar to s3://amzn-s3-demo-bucket/metadata) or in the identical folder because the referenced file.

Right here’s an instance of the information collectively in the identical folder:

One other instance with a devoted “metadata” folder:

Steps to configure

1. Create a .metadata.json file for every doc that you just wish to index, together with the AccessControlList area.
2. Add the metadata information to your S3 bucket in both a devoted metadata folder or in the identical folder as every matching S3 file.
3. Within the Fast console, navigate to Data.
4. Choose Amazon S3 as a brand new information base.
5. Beneath Extra settings, activate the entry management record (ACL) choice.
6. For metadata file location, select one of many following choices:
   1. Identical folder choice: Depart the metadata folder location clean.

• 1. Devoted folder choice: Within the Metadata folder location area, enter the S3 URI to your metadata folder (for instance, s3://amzn-s3-demo-bucket/metadata/).

1. Select Create.
2. Begin a sync. Fast reads the ACL entries from every metadata file and enforces them at question time.

Verifying your configuration

After your information base sync completes, you’ll be able to confirm that ACLs are working appropriately via chat and flows.

Chat

To confirm ACLs in chat:

1. Open a chat in Fast and hook up with your ACL-enabled information base.
2. Disable internet search on the backside of your chat session to isolate outcomes to your information base.
3. Ask a query a couple of doc that you’ve got entry to. You need to obtain a related response.

4. Ask a query a couple of doc that you just don’t have entry to. Fast shouldn’t floor content material from that doc.

The ACL verification confirms that Fast is filtering responses primarily based in your id and ACL configuration.

Flows

With Fast Flows and S3 ACLs, you’ll be able to construct clever, permission-aware automation pipelines that respect information governance whereas delivering insights at scale.

The next instance explores a stream idea: ACL-aware flows for government summaries.

The stream comprises the next steps:

1. Set off and person context: A person submits a subject utilizing the Chat or Move console. The stream captures their id for entry analysis.
2. S3 ACL analysis: The stream checks ACL configurations to find out which paperwork you’ll be able to entry, implementing information governance on the automation layer.
3. Inner abstract era: If licensed paperwork exist, the stream retrieves them and produces an government abstract from inside sources.
4. Internet search fallback: When no inside sources are accessible, the stream robotically searches the net. Exterior summaries are clearly labeled for transparency. That is an non-obligatory step of the Move.

You’ll be able to additional increase this use case by passing the abstract to a downstream step that creates a structured slide deck for management briefings, or by including an electronic mail step to ship summaries to customers or distribution lists on a recurring schedule.

Updating ACLs after preliminary setup

When your group evolves (new hires, crew adjustments, function transitions), replace your entry management configuration accordingly. Fast doesn’t monitor your ACL information for adjustments in actual time. Up to date permissions take impact on the subsequent information base sync, which runs each day by default. For time-sensitive adjustments similar to revoking entry, set off a handbook sync instantly after updating your ACL information. To replace permissions:

1. Replace your ACL information in S3. Modify your international ACL file or the related document-level metadata information to replicate the brand new permissions (including customers, eradicating entry, altering group memberships, and so forth).
2. Resync your information base. After importing the up to date information to S3, set off a brand new sync in your information base from the Fast console. Fast re-evaluates the ACL entries through the sync and updates the index accordingly.

Till the sync completes, the earlier permissions stay in impact.

The reindex scope relies on which configuration methodology you employ:

• World ACL file. All the affected prefix is reindexed.
• Doc-level metadata. Solely the paperwork whose metadata information modified are reindexed.

When you anticipate frequent permission adjustments, document-level metadata information offer you sooner turnaround on entry updates.

Securing your ACL information

Prohibit s3:PutObject permissions in your ACL and metadata information to a restricted set of directors. Anybody who can modify these information can grant themselves entry to any doc, so deal with write entry to ACL information as a privileged operation. Allow S3 versioning in your ACL information to take care of an audit path of permission adjustments. For document-level metadata information, assign possession to crew members aware of the sensitivity of every doc set, similar to information house owners or safety leads, in order that permission choices keep aligned with enterprise context.

Monitoring and auditing ACL exercise

For a safety function like document-level ACLs, visibility into configuration adjustments and entry patterns is crucial. Amazon Fast supplies a number of mechanisms that can assist you monitor and audit your ACL-enabled information bases.

All information base create and replace actions are logged in AWS CloudTrail, together with whether or not ACLs are enabled on the information base. This offers directors an audit path of who configured ACLs and when, serving to you observe adjustments to your entry management setup and examine any surprising modifications.

Amazon Fast additionally supplies a function for monitoring the scale of your information bases, which will help you observe progress and detect surprising adjustments in listed content material. For extra particulars, see monitor index storage utilization within the Fast documentation.

Limitations and concerns

Earlier than you activate ACLs in your S3 information base, concentrate on the next:

• ACLs can’t be disabled after they’re enabled. Turning on document-level ACLs on a information base is a one-way operation. If you must take away ACL performance later, it’s essential to create a brand new information base with out ACLs.
• Consumer id matching is email-based. The Title area in your ACL entries should precisely match the e-mail handle related to the person’s Fast id. If a person’s electronic mail adjustments, replace your ACL information and resync.

For added limitations, see S3 information supply connector limitations and Data base ACL limitations within the Amazon Fast documentation.

Clear up sources

When you created sources whereas following this put up and now not want them, take the next steps to keep away from ongoing costs:

1. Delete the information base. Within the Fast console, navigate to Data, choose the information base that you just created, and select Delete.
2. Take away ACL and metadata information. Delete the worldwide ACL file and document-level .metadata.json information out of your S3 bucket in the event that they had been created for testing functions.
3. Take away IAM insurance policies. When you created an IAM coverage for S3 bucket entry restrictions, first take away the IAM coverage project within the Fast admin console, then delete the IAM coverage itself within the IAM console.

Conclusion

Doc-level ACLs for Amazon S3 information bases in Amazon Fast offer you granular management over who can entry particular paperwork in your information base. On this put up, you configured IAM coverage assignments to manage information base creation, deliberate an entry management construction, arrange each World ACL information and document-level metadata information, verified your configuration via chat and Flows, and realized how you can troubleshoot frequent points.

With these controls in place, you’ll be able to confidently increase the content material in your information bases, understanding that every person solely sees the paperwork and information they’re licensed to entry. This helps your group get extra worth from Fast whereas assembly safety, compliance, and information governance necessities. Fast Flows extends these controls into automated workflows, checking person entry at runtime and producing outputs from solely the paperwork a person is permitted to see. With document-level ACLs, your group can confidently use AI to unlock the worth of delicate information, securely.

Subsequent steps

To proceed constructing on what you’ve realized:

• Assessment the Amazon S3 connector documentation for detailed configuration reference.
• Learn the ACL finest practices information for suggestions on structuring your entry controls at scale.
• Attempt establishing ACLs on a check information base with pattern paperwork earlier than rolling out to manufacturing. Begin with a small set of paperwork and some check customers, then increase when you’ve verified the configuration works as anticipated.

To be taught extra about Amazon Fast, go to the Fast product web page, discover the safety features in Fast, and be part of the Quick Community to ask questions and share your experiences.

In regards to the authors