Access Management

Overview

MinIO uses Policy-Based Access Control (PBAC) to define the authorized actions and resources to which an authenticated user has access. Each policy describes one or more actions and conditions that outline the permissions of a user or group of users.

MinIO PBAC is built for compatibility with AWS IAM policy syntax, structure, and behavior. The MinIO documentation makes a best-effort to cover IAM-specific behavior and functionality. Consider deferring to the IAM documentation for more complete documentation on AWS IAM-specific topics.

The mc admin policy command supports creation and management of policies on the MinIO deployment. See the command reference for examples of usage.

Tag-Based Policy Conditions

Built-In Policies

MinIO provides the following built-in policies for assigning to users or groups:

consoleAdmin

userpolicy

Grants complete access to all S3 and administrative API operations against all resources on the MinIO deployment. Equivalent to the following set of actions:

• s3:*
• admin:*

readonly

userpolicy

Grants read-only permissions on any object on the MinIO deployment. The GET action must apply to a specific object without requiring any listing. Equivalent to the following set of actions:

• s3:GetBucketLocation
• s3:GetObject

For example, this policy specifically supports GET operations on objects at a specific path (e.g. GET play/mybucket/object.file), such as:

• mc cp
• mc stat
• mc head
• mc cat

The exclusion of listing permissions is intentional, as typical use cases do not intend for a “read-only” role to have complete discoverability (listing all buckets and objects) on the object storage resource.

readwrite

userpolicy

Grants read and write permissions for all buckets and objects on the MinIO server. Equivalent to s3:*.

diagnostics

userpolicy

Grants permission to perform diagnostic actions on the MinIO deployment. Specifically includes the following actions:

• admin:ServerTrace
• admin:Profiling
• admin:ConsoleLog
• admin:ServerInfo
• admin:TopLocksInfo
• admin:OBDInfo
• admin:BandwidthMonitor
• admin:Prometheus

writeonly

userpolicy

Grants write-only permissions to any namespace (bucket and path to object) the MinIO deployment. The PUT action must apply to a specific object location without requiring any listing. Equivalent to the s3:PutObject action.

Use mc admin policy attach to associate a policy to a user or group on a MinIO deployment.

For example, consider the following table of users. Each user is assigned a built-in policy or a supported action. The table describes a subset of operations a client could perform if authenticated as that user:

Each user can access only those resources and operations which are explicitly granted by the built-in role. MinIO denies access to any other resource or action by default.

Policy Document Structure

MinIO policy documents use the same schema as AWS IAM Policy documents.

The following sample document provides a template for creating custom policies for use with a MinIO deployment. For more complete documentation on IAM policy elements, see the IAM JSON Policy Elements Reference.

The maximum size for any single policy document is 20KiB. There is no limit to the number of policy documents that can be attached to a user or group.

{
   "Version" : "2012-10-17",
   "Statement" : [
      {
         "Effect" : "Allow",
         "Action" : [ "s3:<ActionName>", ... ],
         "Resource" : "arn:aws:s3:::*",
         "Condition" : { ... }
      },
      {
         "Effect" : "Deny",
         "Action" : [ "s3:<ActionName>", ... ],
         "Resource" : "arn:aws:s3:::*",
         "Condition" : { ... }
      }
   ]
}

• For the Statement.Action array, specify one or more supported S3 API operations.

• For the Statement.Resource key, specify the bucket or bucket prefix to which to restrict the policy. You can use * and ? wildcard characters as per the S3 Resource Spec.

  The * wildcard may result in unintended application of a policy to multiple buckets or prefixes based on the pattern match. For example, arn:aws:s3:::data* would match the buckets data, data_private, and data_internal. Specifying only * as the resource key applies the policy to all buckets and prefixes on the deployment.

  An object pattern and a bucket ARN are not interchangeable. See Bucket and Object Resources.

• For the Statement.Condition key, you can specify one or more supported Conditions.

Bucket and Object Resources

A resource ARN either names a bucket or names objects within it, and the two forms authorize different operations:

• arn:aws:s3:::mybucket names the bucket itself, and authorizes bucket-level operations such as ListBucket or PutBucketPolicy.
• arn:aws:s3:::mybucket/* names the objects in the bucket, and authorizes object operations such as GetObject or PutObject.

Grant both when a principal needs both, which is the conventional form for a policy that manages a bucket and its contents:

"Resource": ["arn:aws:s3:::mybucket", "arn:aws:s3:::mybucket/*"]

Everything else is unchanged. ListBucket, GetBucketLocation, the bucket configuration reads, and CreateBucket are still authorized through an object pattern, so listing and provisioning flows written that way keep working. Deny statements and NotResource exclusions match as they always did, so no restriction written against mybucket/* is weakened. The built-in readwrite, readonly, writeonly and diagnostics policies use arn:aws:s3:::* and are unaffected.

Supported S3 Policy Actions

MinIO policy documents support a subset of IAM S3 Action keys. This section also includes any condition keys supported by a specific action beyond the common set of supported keys.

The following actions control access to common S3 operations. The remaining subsections document actions for more advanced S3 operations:

s3:*

policy-action

Selector for all MinIO S3 operations. Applying this action to a given resource allows the user to perform any S3 operation against that resource.

s3:CreateBucket

policy-action

Controls access to the CreateBucket S3 API operation.

s3:DeleteBucket

policy-action

Controls access to the DeleteBucket S3 API operation.

s3:ForceDeleteBucket

policy-action

Controls access to the DeleteBucket S3 API operation for operations with the x-minio-force-delete flag. Required for removing non-empty buckets.

s3:GetBucketLocation

policy-action

Controls access to the GetBucketLocation S3 API operation.

s3:ListAllMyBuckets

policy-action

Controls access to the ListBuckets S3 API operation.

s3:DeleteObject

policy-action

Controls access to the DeleteObject S3 API operation.

Supports the following additional condition key:

s3:versionid

s3:GetObject

policy-action

Controls access to the GetObject S3 API operation.

Supports the following additional condition keys:

s3:x-amz-server-side-encryption
s3:x-amz-server-side-encryption-customer-algorithm
s3:x-amz-server-side-encryption-aws-kms-key-id
s3:ExistingObjectTag/<key>
s3:versionid

s3:GetObjectAttributes

policy-action

Controls access to the GetObjectAttributes S3 API operation.

The policy parser admits the following condition key for this action:

s3:ExistingObjectTag/<key>

The current handler authorizes before it loads object metadata, however, so that condition value is absent for this operation.

s3:GetObjectVersionAttributes

policy-action

Controls access to the GetObjectAttributes S3 API operations on versioned objects.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>

The version ID comes from the request query. The current handler authorizes before it loads object metadata, so s3:ExistingObjectTag/<key> is admitted by the policy parser but absent at evaluation time for this operation.

s3:RestoreObject

policy-action

Controls access to the RestoreObject S3 API operation.

s3:ListBucket

policy-action

Controls access to the ListObjectsV2 S3 API operation.

Supports the following additional condition keys:

s3:prefix
s3:delimiter
s3:max-keys

s3:PutObject

policy-action

Controls access to the PutObject S3 API operation.

Supports the following additional condition keys:

s3:x-amz-copy-source
s3:x-amz-server-side-encryption
s3:x-amz-server-side-encryption-customer-algorithm
s3:x-amz-server-side-encryption-aws-kms-key-id
s3:x-amz-metadata-directive
s3:x-amz-storage-class
s3:versionid
s3:object-lock-retain-until-date
s3:object-lock-mode
s3:object-lock-legal-hold
s3:RequestObjectTagKeys
s3:RequestObjectTag/<key>

s3:PutObjectTagging

policy-action

Controls access to the PutObjectTagging S3 API operation.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>
s3:RequestObjectTagKeys
s3:RequestObjectTag/<key>

s3:GetObjectTagging

policy-action

Controls access to the GetObjectTagging S3 API operation.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>

s3:DeleteObjectTagging

policy-action

Controls access to the DeleteObjectTagging S3 API operation.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>

Bucket Configuration

s3:GetBucketPolicy

policy-action

Controls access to the GetBucketPolicy S3 API operation.

s3:PutBucketPolicy

policy-action

Controls access to the PutBucketPolicy S3 API operation.

s3:DeleteBucketPolicy

policy-action

Controls access to the DeleteBucketPolicy S3 API operation.

s3:GetBucketTagging

policy-action

Controls access to the GetBucketTagging S3 API operation.

s3:PutBucketTagging

policy-action

Controls access to the PutBucketTagging S3 API operation.

The policy parser retains the following condition keys for compatibility:

s3:RequestObjectTagKeys
s3:RequestObjectTag/<key>

The handler does not populate them from the bucket-tagging XML body. Only the historical, client-supplied X-Amz-Tagging Header fallback can populate them, and that Header does not constrain the bucket tags stored from the body. Do not use these keys to enforce the contents of a PutBucketTagging request.

s3:GetBucketPolicyStatus

policy-action

Controls access to the GetBucketPolicyStatus S3 API operation.

Multipart Upload

s3:AbortMultipartUpload

policy-action

Controls access to the AbortMultipartUpload S3 API operation.

s3:ListMultipartUploadParts

policy-action

Controls access to the ListParts S3 API operation.

s3:ListBucketMultipartUploads

policy-action

Controls access to the ListMultipartUploads S3 API operation.

Versioning and Retention

s3:PutBucketVersioning

policy-action

Controls access to the PutBucketVersioning S3 API operation.

s3:GetBucketVersioning

policy-action

Controls access to the GetBucketVersioning S3 API operation.

s3:DeleteObjectVersion

policy-action

Controls access to the DeleteObjectVersion S3 API operation.

Supports the following additional condition keys:

s3:versionid

s3:ListBucketVersions

policy-action

Controls access to the ListBucketVersions S3 API operation.

Supports the following additional condition keys:

s3:prefix
s3:delimiter
s3:max-keys

s3:PutObjectVersionTagging

policy-action

Controls access to the PutObjectVersionTagging S3 API operation.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>
s3:RequestObjectTagKeys
s3:RequestObjectTag/<key>

s3:GetObjectVersionTagging

policy-action

Controls access to the GetObjectVersionTagging S3 API operation.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>

s3:DeleteObjectVersionTagging

policy-action

Controls access to the DeleteObjectVersionTagging S3 API operation.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>

s3:GetObjectVersion

policy-action

Controls access to the GetObjectVersion S3 API operation.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>

s3:BypassGovernanceRetention

policy-action

Controls access to the following S3 API operations on objects locked under GOVERNANCE retention mode:

• s3:PutObjectRetention
• s3:PutObject
• s3:DeleteObject

See the S3 documentation on s3:BypassGovernanceRetention for more information.

Supports the following additional condition keys:

s3:versionid
s3:object-lock-remaining-retention-days
s3:object-lock-retain-until-date
s3:object-lock-mode
s3:object-lock-legal-hold
s3:RequestObjectTagKeys
s3:RequestObjectTag/<key>

s3:PutObjectRetention

policy-action

Controls access to the PutObjectRetention S3 API operation.

Required for any PutObject operation that specifies retention metadata.

Supports the following additional condition keys:

s3:x-amz-server-side-encryption
s3:x-amz-server-side-encryption-customer-algorithm
s3:x-amz-server-side-encryption-aws-kms-key-id
s3:object-lock-remaining-retention-days
s3:object-lock-retain-until-date
s3:object-lock-mode
s3:versionid

s3:GetObjectRetention

policy-action

Controls access to the GetObjectRetention S3 API operation.

Required for including object locking metadata as part of the response to a GetObject or HeadObject operation.

Supports the following additional condition keys:

s3:x-amz-server-side-encryption
s3:x-amz-server-side-encryption-customer-algorithm
s3:x-amz-server-side-encryption-aws-kms-key-id
s3:versionid

s3:GetObjectLegalHold

policy-action

Controls access to the GetObjectLegalHold S3 API operation.

Required for including object locking metadata as part of the response to a GetObject or HeadObject operation.

s3:PutObjectLegalHold

policy-action

Controls access to the PutObjectLegalHold S3 API operation.

Required for any PutObject operation that specifies legal hold metadata.

Supports the following additional condition keys:

s3:x-amz-server-side-encryption
s3:x-amz-server-side-encryption-customer-algorithm
s3:x-amz-server-side-encryption-aws-kms-key-id
s3:object-lock-legal-hold
s3:versionid

s3:GetBucketObjectLockConfiguration

policy-action

Controls access to the GetObjectLockConfiguration S3 API operation.

s3:PutBucketObjectLockConfiguration

policy-action

Controls access to the PutObjectLockConfiguration S3 API operation.

Bucket Notifications

s3:GetBucketNotification

policy-action

Controls access to the GetBucketNotification S3 API operation.

s3:PutBucketNotification

policy-action

Controls access to the PutBucketNotification S3 API operation.

s3:ListenNotification

policy-action

MinIO Extension for controlling API operations related to MinIO Bucket Notifications.

This action is not intended for use with other S3-compatible services.

s3:ListenBucketNotification

policy-action

MinIO Extension for controlling API operations related to MinIO Bucket Notifications.

This action is not intended for use with other S3-compatible services.

Object Lifecycle Management

s3:PutLifecycleConfiguration

policy-action

Controls access to the PutLifecycleConfiguration S3 API operation.

s3:GetLifecycleConfiguration

policy-action

Controls access to the GetLifecycleConfiguration S3 API operation.

Object Encryption

s3:PutEncryptionConfiguration

policy-action

Controls access to the PutEncryptionConfiguration S3 API operation.

s3:GetEncryptionConfiguration

policy-action

Controls access to the GetEncryptionConfiguration S3 API operation.

Bucket Replication

s3:GetReplicationConfiguration

policy-action

Controls access to the GetBucketReplication S3 API operation.

s3:PutReplicationConfiguration

policy-action

Controls access to the PutBucketReplication S3 API operation.

s3:ReplicateObject

policy-action

MinIO Extension for controlling API operations related to Server-Side Bucket Replication.

Required for MinIO server-side replication.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>

s3:ReplicateDelete

policy-action

MinIO Extension for controlling API operations related to Server-Side Bucket Replication.

Required for synchronizing delete operations as part of MinIO server-side replication.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>

s3:ReplicateTags

policy-action

MinIO Extension for controlling API operations related to Server-Side Bucket Replication.

Required for MinIO server-side replication.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>

s3:GetObjectVersionForReplication

policy-action

MinIO Extension for controlling API operations related to Server-Side Bucket Replication.

Required for MinIO server-side replication.

Supports the following additional condition keys:

s3:versionid
s3:ExistingObjectTag/<key>

Supported S3 Policy Condition Keys

MinIO policy documents support IAM conditional statements.

Each condition element consists of operators and condition keys. MinIO supports a subset of IAM condition keys. For complete information on any listed condition key, see the IAM Condition Element Documentation

MinIO supports the following condition keys for all supported actions:

• aws:Referer
• aws:SourceIp
• aws:UserAgent
• aws:SecureTransport
• aws:CurrentTime
• aws:EpochTime
• aws:PrincipalType
• aws:userid
• aws:username
• s3:x-amz-content-sha256
• s3:signatureAge

Condition Value Sources and Precedence

Silo constructs the condition-value map from semantic request sources instead of treating every header and query parameter as interchangeable. A raw header or query parameter whose name resembles an internal condition key cannot replace a value calculated by the server or create one that the server did not provide.

If an API path does not load or calculate a listed source, that condition key is absent. Its result then follows the semantics of the policy operator in use; do not assume that merely listing a key for an action causes the server to synthesize a value.

For additional keys supported by a specific S3 action, see the reference documentation for that action.

MinIO Extended Condition Keys

MinIO extends the S3 standard condition keys with the following extended key:

sts:DurationSeconds

Note

Added: MinIO

SERVER RELEASE.2024-02-06T21-36-22Z

Specify a time in seconds to limit the duration of all Security Token Service credentials generated by AssumeRoleWithWebIdentity.

This value overrides the DurationSeconds field specified to the client.

For example:

{
   "Version": "2012-10-17",
   "Statement": [
      {
            "Effect": "Allow",
            "Action": [
               "sts:AssumeRoleWithWebIdentity"
            ],
            "Condition": {
               "NumericLessThanEquals": {
                  "sts:DurationSeconds": "300"
               }
            }
      }
   ]
}

mc admin Policy Action Keys

MinIO supports the following actions for use with defining policies for mc admin operations. These actions are only valid for MinIO deployments and are not intended for use with other S3-compatible services:

admin:*

policy-action

Selector for all admin action keys.

admin:Heal

policy-action

Allows heal command

admin:StorageInfo

policy-action

Allows listing server info

admin:DataUsageInfo

policy-action

Allows listing data usage info

admin:TopLocksInfo

policy-action

Allows listing top locks

admin:Profiling

policy-action

Allows profiling

admin:ServerTrace

policy-action

Allows listing server trace

admin:ConsoleLog

policy-action

Allows listing console logs on terminal

admin:KMSCreateKey

policy-action

Allows creating a new KMS master key

While this option is still supported, kms:CreateKey is preferred.

admin:KMSKeyStatus

policy-action

Allows getting KMS key status

While this option is still supported, kms:KeyStatus is preferred.

admin:ServerInfo

policy-action

Allows listing server info

admin:OBDInfo

policy-action

Allows obtaining cluster on-board diagnostics

admin:ServerUpdate

policy-action

Allows MinIO binary update

admin:ServiceRestart

policy-action

Allows restart of MinIO service.

admin:ServiceStop

policy-action

Allows stopping MinIO service.

admin:ConfigUpdate

policy-action

Allows MinIO config management

admin:CreateUser

policy-action

Allows creating MinIO user

admin:DeleteUser

policy-action

Allows deleting MinIO user

admin:ListUsers

policy-action

Allows list users permission

admin:EnableUser

policy-action

Allows enable user permission

admin:DisableUser

policy-action

Allows disable user permission

admin:GetUser

policy-action

Allows GET permission on user info

admin:AddUserToGroup

policy-action

Allows adding user to group permission

admin:RemoveUserFromGroup

policy-action

Allows removing user to group permission

admin:GetGroup

policy-action

Allows getting group info

admin:ListGroups

policy-action

Allows list groups permission

admin:EnableGroup

policy-action

Allows enable group permission

admin:DisableGroup

policy-action

Allows disable group permission

admin:CreatePolicy

policy-action

Allows create policy permission

admin:DeletePolicy

policy-action

Allows delete policy permission

admin:GetPolicy

policy-action

Allows get policy permission

admin:AttachUserOrGroupPolicy

policy-action

Allows attaching a policy to a user/group

admin:ListUserPolicies

policy-action

Allows listing user policies

admin:CreateServiceAccount

policy-action

Allows creating MinIO Access Key

admin:UpdateServiceAccount

policy-action

Allows updating MinIO Access Key

admin:RemoveServiceAccount

policy-action

Allows deleting MinIO Access Key

admin:ListServiceAccounts

policy-action

Allows listing MinIO Access Key

admin:SetBucketQuota

policy-action

Allows setting bucket quota

admin:GetBucketQuota

policy-action

Allows getting bucket quota

admin:SetBucketTarget

policy-action

Allows setting bucket target

admin:GetBucketTarget

policy-action

Allows getting bucket targets

admin:SetTier

policy-action

Allows creating and modifying remote storage tiers using the mc ilm tier commands.

admin:ListTier

policy-action

Allows listing configured remote storage tiers using the mc ilm tier commands.

admin:BandwidthMonitor

policy-action

Allows retrieving metrics related to current bandwidth consumption.

admin:Prometheus

policy-action

Allows access to MinIO metrics. Only required if MinIO requires authentication for scraping metrics.

admin:ListBatchJobs

policy-action

Allows access to list the active batch jobs.

admin:DescribeBatchJob

policy-action

Allows access to the see the definition details of a running batch job.

admin:StartBatchJob

policy-action

Allows user to begin a batch job run.

admin:CancelBatchJob

policy-action

Allows user to stop a batch job currently in process.

admin:Rebalance

policy-action

Allows access to start, query, or stop a rebalancing of objects across pools with varying free storage space.

KMS policy action keys

MinIO supports restricting key management service (KMS) actions by policy.

You can restrict KMS activities in a policy with any of the following KMS actions:

kms:Status

policy-action

Check the status of KMS.

kms:Metrics

policy-action

Obtain Prometheus-formatted metrics.

kms:API

policy-action

List supported API endpoints.

kms:Version

policy-action

Retrieve the KMS version.

kms:CreateKey

policy-action

Create a new KMS key.

kms:ListKeys

policy-action

Retrieve a list of existing KMS keys.

kms:KeyStatus

policy-action

Retrieve the status of a specified KMS key.

To select all of the available kms policy actions, use kms:*.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:CreateKey",
                "kms:KeyStatus",
                "kms:ListKeys"
            ],
            "Resource": [
                "arn:minio:kms:::keys-abc-*",
                "arn:minio:kms:::myuser-*"
            ]
        }
    ]
}

mc admin Policy Condition Keys

MinIO supports the following conditions for use with defining policies for mc admin actions.

• aws:Referer
• aws:SourceIp
• aws:UserAgent
• aws:SecureTransport
• aws:CurrentTime
• aws:EpochTime

For complete information on any listed condition key, see the IAM Condition Element Documentation.

Policy Variables

MinIO supports using policy variables for automatically substituting context from the authenticated user and/or the operation into the user’s assigned policy or policies. Use the ${POLICYVARIABLE} format to specify the variable to the policy as part of the Condition or Resource definition. MinIO policy variables function similarly to AWS IAM policy elements: Variables and tags.

Each MinIO identity provider supports its own set of policy variables:

• MinIO Policy Variables
• OpenID Policy Variables
• Active Directory / LDAP Policy Variables

MinIO Policy Variables

The following table contains a list of recommended policy variables for use in authorizing MinIO-managed users:

For example, the following policy uses variables to substitute the authenticated user’s username as part of the Resource field such that the user can only access those prefixes which match their username:

{
"Version": "2012-10-17",
"Statement": [
      {
         "Action": ["s3:ListBucket"],
         "Effect": "Allow",
         "Resource": ["arn:aws:s3:::mybucket"],
         "Condition": {"StringLike": {"s3:prefix": ["${aws:username}/*"]}}
      },
      {
         "Action": [
         "s3:GetObject",
         "s3:PutObject"
         ],
         "Effect": "Allow",
         "Resource": ["arn:aws:s3:::mybucket/${aws:username}/*"]
      }
   ]
}

MinIO replaces the ${aws:username} variable in the Resource field with the username. MinIO then evaluates the policy and grants or revokes access to the requested API and resource.

OpenID Policy Variables

The following table contains a list of supported policy variables for use in authorizing OIDC-managed users.

Each variable corresponds to a claim returned as part of the authenticated user’s JWT token:

See the OpenID Connect Core 1.0 document for more information on these scopes. Your OIDC provider of choice may have more specific documentation.

For example, the following policy uses variables to substitute the authenticated user’s preferred_username as part of the Resource field such that the user can only access those prefixes which match their username:

{
"Version": "2012-10-17",
"Statement": [
      {
         "Action": ["s3:ListBucket"],
         "Effect": "Allow",
         "Resource": ["arn:aws:s3:::mybucket"],
         "Condition": {"StringLike": {"s3:prefix": ["${jwt:preferred_username}/*"]}}
      },
      {
         "Action": [
         "s3:GetObject",
         "s3:PutObject"
         ],
         "Effect": "Allow",
         "Resource": ["arn:aws:s3:::mybucket/${jwt:preferred_username}/*"]
      }
   ]
}

MinIO replaces the ${jwt:preferred_username} variable in the Resource field with the value of the preferred_username in the JWT token. MinIO then evaluates the policy and grants or revokes access to the requested API and resource.

Active Directory / LDAP Policy Variables

The following table contains a list of supported policy variables for use in authorizing AD/LDAP users:

For example, the following policy uses variables to substitute the authenticated user’s name as part of the Resource field such that the user can only access those prefixes which match their name:

{
"Version": "2012-10-17",
"Statement": [
      {
         "Action": ["s3:ListBucket"],
         "Effect": "Allow",
         "Resource": ["arn:aws:s3:::mybucket"],
         "Condition": {"StringLike": {"s3:prefix": ["${ldap:username}/*"]}}
      },
      {
         "Action": [
         "s3:GetObject",
         "s3:PutObject"
         ],
         "Effect": "Allow",
         "Resource": ["arn:aws:s3:::mybucket/${ldap:username}/*"]
      }
   ]
}

MinIO replaces the ${ldap:username} variable in the Resource field with the value of the authenticated user’s name. MinIO then evaluates the policy and grants or revokes access to the requested API and resource.