The Ranger-S3 plugin extends Ranger's authorization capabilities to Amazon S3 resources, enabling centralized access control, and policy management for S3 buckets and objects accessed through various big data ecosystem components. This shall facilitate the Hadoop and data platform teams in managing S3 resource access internally without continuous DevOps support.

Ranger S3 service contains two types of S3 policies:

1. Bucket-Level Policies:

Resource format: bucket1/, bucket2/
Actions: s3:ListBucket
Purpose: Allow users to list objects in bucket without accessing contents

2. Object-Level Policies:

Resource format: bucket1/*, bucket/prefix/*
Actions: s3:GetObject, s3:PutObject, s3:DeleteObject
Purpose: Grant read/write/delete access to objects within buckets

The user is required to create separate policies for buckets and objects with respective permissions.

Additionally, the plugin supports bi-directional sync between Ranger and IAM resource-based policy, with permissions set in Ranger taking precedence. Bi-directional sync here states that if IAM has additional users for given resource, changes in Ranger will be appended in existing policy at the IAM end. Additional users will not be visible on Ranger UI. If IAM resource-based policy has certain permissions to a user, and permissions are changed from Ranger UI for same user, then Ranger permissions shall be overwritten onto the resource-based policy in IAM.

The resultant statements in IAM policies shall be applied when Hadoop services access respective S3 resource (s).