SeaWall: Building a Planetary-Scale S3 Gateway with Envoy
summary
SeaWall is an Envoy-based S3 gateway that handles 81 billion requests/week and cuts authorization latency from ~20 ms to sub-ms auth latency by using gRPC ext_authz filters that parse S3 operations in-band and return dynamic metadata. A two-pass header-first auth avoids buffering except when body checks are required, with strict size limits; rate limits use a Redis-backed global counter plus local Infoblox caches and graylisting to prevent Redis cascades. Deployments use SIGHUP reloads and enriched access logs for faster incident debugging.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:25Object storage edge challenges
- 3:11Envoy’s auth filter design
- 4:39Multi-stage auth pipeline
- 6:03Request bodies in S3 auth
- 7:49Policy enforcement and rate limiting
- 9:14Auth failure modes and resilience
- 10:42Key lessons and benefits
- 11:05Q&A
related talks
11mLightning Talk: Building a Scalable Multi-Protocol API Gateway with Envoy
26mSecuring the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol...
27mEnvoy Proxy: Evolved for Serving LLMs
15mFrom ingress-nginx to Envoy Gateway at Zapier: The...
15mFail Open, Fail Fast: Improving Envoy Resilience in Latency-Critical Systems
33mGet to know Envoy - the modern proxy for cloud-native infrastructure - Baptiste Collard
32mBuilding Zero Trust with Envoy
38mEnvoy Deep Dive