Object Storage - Identity and access management

Objective

This guide explains how to manage identities and access to your Object Storage resources.

Requirements

• A Public Cloud project in your OVHcloud account

OVHcloud Console Access

• Direct link: Projects
• Navigation path: Public Cloud > Select your project > Storage > Object Storage

Instructions

In the left-hand menu of your Public Cloud project, click Object Storage under Storage, then open the Users tab.

Creating a user

Click Create a user, enter a name for the user and click Create. The new user gets the Object Storage Operator role and its S3¹ credentials.

Once your user has been created, its credentials are displayed. Save them: the secret key is shown only once.

If you already have OpenStack users, they are listed in the Users tab. To give one of them access to Object Storage, click the ... button on its row, then Enable Object Storage (S3): its S3 credentials are generated.

Manage access to a bucket via a profile

You can define access to your buckets via predefined profiles.

In the Containers tab, click the ... button at the end of your bucket line, then Add S3 user.

Select the user to add to your bucket, choose their Role (Administrator, Read and write, Read-only or Deny), then click Add.

Advanced resource access management

Overview

By default, all resources (buckets, objects) and sub-resources (lifecycle configuration, website configuration, etc.) are private in Object Storage. Only the resource owner, i.e., the user account that creates it, has full control.

Access to private resources can be granted via access policies. Access policies can be categorized broadly into two types:

• user-based: access policies attached to a specific user are called user policies. A user policy is evaluated using Object Storage IAM permissions and applies only to the specific user it is attached to.
• resource-based: bucket policies and ACLs are policies that are attached directly to specific resources.

You can refine your permissions by importing a JSON configuration file. To do this, open the Users tab.

Click the ... button at the end of your user's line, then Import a policy. Select your JSON file and click Import. The imported policy replaces the user's current policy.

Understanding the user policy evaluation process

At the moment, user permissions are evaluated as follows:

1. if exists, evaluate user policy else fallback to ACLs
   1. check for an explicit deny: if there is an explicit deny, then deny permission, else, check for an explicit allow
   2. check for an explicit allow: if there is an explicit allow, then allow permission
   3. if there is no explicit deny nor explicit allow, then fallback to ACLs
2. fallback to ACLs

Some examples of JSON configuration files:

Read/write access to a bucket and its objects

{
  "Statement":[{
    "Sid": "RWContainer",
    "Effect": "Allow",
    "Action":["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:GetBucketLocation"],
    "Resource":["arn:aws:s3:::<bucket_name>", "arn:aws:s3:::<bucket_name>/*"]
  }]
}

Read-only access to a bucket and its objects

{
  "Statement":[{
    "Sid": "ROContainer",
    "Effect": "Allow",
    "Action":["s3:GetObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads"],
    "Resource":["arn:aws:s3:::<bucket_name>", "arn:aws:s3:::<bucket_name>/*"]
  }]
}

Deny listing of all buckets owned by the parent account

{
  "Statement":[{
    "Sid": "DenyListBucket",
    "Effect": "Deny",
    "Action":["s3:ListAllMyBuckets"],
    "Resource":["*"]
  }]
}

Allow all operations on all project resources

{
  "Statement":[{
    "Sid": "FullAccess",
    "Effect": "Allow",
    "Action":["s3:*"],
    "Resource":["*"]
  }]
}

Read/write access to all objects in a specific folder (/home/user2) in a specific bucket (<bucket_name>)

{
  "Statement":[{
    "Sid": "RWContainer",
    "Effect": "Allow",
    "Action":["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:GetBucketLocation"],
    "Resource":["arn:aws:s3:::<bucket_name>", "arn:aws:s3:::<bucket_name>/home/user2/*"]
  }]
}

Allow all operations to specific IPs by whitelisting authorized IPs

{
  "Statement": [{
    "Sid": "ExampleStatement01",
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": [
      "arn:aws:s3:::<bucket_name>",
      "arn:aws:s3:::<bucket_name>/*"
    ],
    "Condition": {
      "IpAddress": {
        "aws:SourceIp": "10.0.0.5/16"
      }
    }
  }]
} 

The following policy to attempt to allow read access to objects only to specific IPs will not work under current conditions if attached to the bucket owner i.e., even if the bucket owner makes requests from IPs that are not in the specified range, the bucket owner will be authorized.

{
  "Statement": [{
    "Sid": "ExampleStatement01",
    "Effect": "Allow",
    "Action": [
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketVersions"
    ],
    "Resource": [
      "arn:aws:s3:::<bucket_name>/*"
    ],
    "Condition": {
      "IpAddress": {
        "aws:SourceIp": "10.0.0.5/16"
      }
    }
  }]
}

The following policy to attempt to deny read access to objects to specific IPs by blacklisting unauthorized IPs will not work under current conditions if attached to the bucket owner because there is no explicit deny and requests from the specified IPs will not match the allow, therefore, we fall back to the ACLs.

{
  "Statement": [{
    "Sid": "ExampleStatement01",
    "Effect": "Allow",
    "Action": [
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketVersions"
    ],
    "Resource": [
      "arn:aws:s3:::<bucket_name>/*"
    ],
    "Condition": {
      "NotIpAddress": {
        "aws:SourceIp": "10.0.0.5/16"
      }
    }
  }]
}

List of supported actions

Go further

For training or technical assistance implementing our solutions, contact your sales representative or visit our Professional Services page to request a quote and have your project analysed by our experts.

Join our community of users.

¹: S3 is a trademark of Amazon Technologies, Inc. OVHcloud's service is not sponsored by, endorsed by, or otherwise affiliated with Amazon Technologies, Inc.