Is it possible to restrain access to only a single container with swift compatible clouds?
  • Louis Drapeau
    0
    Hi,

    I have many containers, one for each customer, I would love to sell a copy of CloudBerry Explorer to each of my customers so they could check and use their backups as required, however I'm running into an issue in configuring a user/key access that would only allow access to a single container and not all the containers. I'm currently using ovh's PCA (public cloud archive) and even thought they have something in the api to setup access to a specific container, I have not been able to make it work. Suggestions would be welcome, another provider could do if they offer 0.003/GB/month with no minimal storage time. Cheers, Louis
    Louis Drapeau Options
  • Matt
    91
    ↪Louis Drapeau
    You should be able to get that working with the following policy:

    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": [
    "s3:ListBucket",
    "s3:GetBucketLocation",
    "s3:ListBucketMultipartUploads"
    ],
    "Resource": "arn:aws:s3:::mybucket",
    "Condition": {}
    },
    {
    "Effect": "Allow",
    "Action": [
    "s3:AbortMultipartUpload",
    "s3:DeleteObject",
    "s3:DeleteObjectVersion",
    "s3:GetObject",
    "s3:GetObjectAcl",
    "s3:GetObjectVersion",
    "s3:GetObjectVersionAcl",
    "s3:PutObject",
    "s3:PutObjectAcl",
    "s3:PutObjectVersionAcl"
    ],
    "Resource": "arn:aws:s3:::mybucket/*",
    "Condition": {}
    },
    {
    "Effect": "Allow",
    "Action": "s3:ListAllMyBuckets",
    "Resource": "*",
    "Condition": {}
    }
    ]
    }

    Of course, mybucket should be replaced with the name of your bucket for each user you create in your AWS console.
    Matt Options
  • Louis Drapeau
    0
    Hi Matt,

    Many thanks for the great reply. This seems to be very tied to AWS S3, do you think I could implement a comparable policy with my provider OVH that is swift/openstack compatible? Thanks, Louis
    Louis Drapeau Options
  • Matt
    91
    ↪Louis Drapeau
    Oh, sorry, didn't notice that you're using Openstack, my bad.
    Well, I'm honestly not that familiar with giving granular permissions in Swift, but pretty sure they have documentation on that. ACLs might help in that: https://docs.openstack.org/swift/latest/overview_acl.html
    Matt Options
  • Louis Drapeau
    0
    Ok, thanks Matt, I think I'm gona have to dig in a bit and look at ACL's, cheers, Louis
    Louis Drapeau Options
bold
italic
underline
strike
code
quote
ulist
image
url
mention
reveal
youtube
tweet
Add a Comment