Avoiding the Curious Case of Leaky Cauldrons
summary
Covers how Ceph RGW’s S3-compatible features (bucket/user policies, S3 encryption support, lifecycle rules and Nautilus tiering) can be used to prevent accidental public exposure of S3 buckets. Explains the bucket policy language and gives concrete policy patterns — e.g., sharing only images filtered by tags for specific users or source IPs, and automatic object expiry — that provide finer-grained access control than ACLs.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:05SUSE
- 1:45Differences between RGW & Rados objects
- 2:49Fundamentals
- 3:43Controlling Access: S3 API
- 5:28Regular ACLS
- 11:57Example Use Cases
- 14:12Bucket Policy
- 17:38Adding it all up
- 20:25User Policy
- 21:46OPA
- 22:08Conclusion
- 22:46Future Work
related talks
38mSecuring Amazon S3 with guardrails and fine-grained access controls
19mManaging access to your Amazon S3 buckets and objects
19mFoundations of data security
45mAmazon S3 encryption and access control best practices
36mCeph Object Storage Roadmap Session at Cephalocon 2025
26mAchieving a higher level of security so you can sleep better
49mGoogle Cloud Storage - Building Systems with Security by Design and Default
41mLet Your Cloud Native Storage Save You from Ransomware!