Skip to main content
s3Cli is a governed S3 command-line tool in NexusOne’s Jupyter environment. Its core features include:
  • Interacting with S3 buckets in NexusOne
  • Evaluating Apache Ranger policies before executing S3 operations
  • Loading and storing credentials via a Java Cryptography Extension Key Store (JCEKS)

​
Problems s3Cli solves

Prior to the release of s3Cli, you would directly interact with S3 buckets using the AWS Command Line Interface.

Before s3Cli
This architecture creates a problem because there is no centralized policy check within NexusOne. S3 actions allowed depend on the AWS IAM policy assigned to the user performing the action using the AWS command line tool. As a NexusOne customer, this creates a problem in the following ways:
  • You have to reach out to the NexusOne team to update these AWS IAM policies since you don’t manage the NexusOne environment
  • If you manage your NexusOne environment, then you have to manage both the AWS policies and other custom policies, not even related to this feature within Apache Ranger
What s3Cli does is collapse this governance split. IAM authorization still exists, but Ranger is now used as the authorization layer.
after-s3cli

After s3Cli
Now, when you use s3Cli, the following happens:
  1. You perform an S3 action using s3Cli
  2. JCEKS loads your AWS S3, MinIO, or other S3-compatible storage credentials, so s3Cli can authenticate to the storage service before performing any action
  3. Ranger evaluates if you have permission to perform the requested S3 action
  4. The S3 action executes if it’s allowed by Ranger
Hadoop’s core-site.xml file makes it possible to access multiple S3 buckets.

​
Supported s3Cli operations

The s3Cli tool supports the following operations.
OperationDescription
lsList buckets or objects
getDownload a file or directory resurcively
putUpload file or directory
rmDelete file
catPrint file contents
authCheck authorization

​
Additional resources

For more information about the supported flags and how to use it, refer to the s3Cli command line reference page.