Question & Answer
Question
What AWS privileges are required to configure a connection between IBM Storage Protect and an Amazon S3 bucket?
Answer
When IBM Storage Protect runs the validate command, it not only verifies the connection to the S3 endpoint URL but also performs write, read, and delete operations on a test object. This ensures that basic S3 operations are functioning correctly.
To support these operations, the following AWS permissions are required:
Account Level
s3:ListAllMyBuckets
Bucket Level
s3:ListBucket
s3:ListBucketMultipartUploads
Object Level
s3:PutObject
s3:GetObject
s3:DeleteObject
s3:ListMultipartUploadParts
s3:AbortMultipartUpload
Sample Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Account Level",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": "*"
},
{
"Sid": "Bucket" Level,
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:ListBucketMultipartUploads"
],
"Resource": "arn:aws:s3::: <Bucket Name>"
},
{
"Sid": "Object Level",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload"
],
"Resource": "arn:aws:s3:::<Bucket Name>/*"
}
]
}
Note: The above privileges can be updated at the AWS end, which is outside the scope of Spectrum Protect. Therefore, please coordinate with your cloud team before making any changes at the bucket level.
Related Information
Product Synonym
IBM Storage Protect,ISP,TSM
Was this topic helpful?
Document Information
Modified date:
25 February 2026
UID
ibm17261501