Version 2.9.124
FeatureStorage
Give Every Workload Its Own Key, Limited to One Folder
Several workloads can now share one bucket, each with its own key that reaches only its own folder.
- In Security, S3 credentials, choose By bucket policy when you create an access key: the key has no access of its own and reaches only what a bucket policy gives it
- In a bucket's Access tab, click Edit policy and use Give a key access to a folder: pick the key, the folder or the whole bucket, and a level (read only, read and write, or full access), then save
Show 5 more changes
- Saving a policy asks you to confirm it's you, and we email you whenever what you saved changed the policy
- Keys created for chosen buckets or by bucket policy have an ARN of their own, shown when you create the key and in its details, so a policy can name one key and no other
- The same works over the API (scope none for a key, and endpoints to read and replace a bucket's policy or add a folder grant) and in danube CLI 1.7 with danube storage keys create --scope none and danube storage policy get, set and grant
- A key limited to a folder cannot list the top level of the bucket, so point your S3 client at the folder; about 30 folder grants fit in one bucket policy; a key that reaches a bucket only through its policy cannot be used for SFTP on it
- Folder grants work on buckets hosted on the current high-durability storage endpoint, the buckets that have the policy editor