Object Storage - Identity and access management

Requirements

• A Public Cloud project in your OVHcloud account

OVHcloud Control Panel Access

• Direct link: Public Cloud Projects
• Navigation path: Public Cloud > Select your project

Instructions

Creating a user

Click on Object Storage in the left-hand menu.

Choose the Users tab and click + Create User.

In the pop-up window, enter a description for your user and click Create.

Once your user has been created, you will see the credentials:

Manage access to a container via a profile

You can define access to your containers via pre-defined profiles.

From the My containers tab, click on the more options ... button at the end of your container line, and then select Add user from the drop-down menu.

Select the user, choose a role, and click Add.

Advanced resource access management

Overview

By default, all resources (buckets, objects) and sub-resources (lifecycle configuration, website configuration, etc.) are private in Object Storage. Only the resource owner, i.e., the user account that creates it, has full control.

Access to private resources can be granted via access policies. Access policies can be categorized broadly into two types:

• user-based: access policies attached to a specific user are called user policies. A user policy is evaluated using Object Storage IAM permissions and applies only to the specific user it is attached to.
• resource-based: bucket policies and ACLs are policies that are attached directly to specific resources

You can refine your permissions by importing a JSON configuration file. To do this, go to the Users tab.

Click on the more options ... at the end of your user’s line, then Import a user access policy (JSON).

Understanding the user policy evaluation process

At the moment, user permissions are evaluated as follows:

1. if exists, evaluate user policy else fallback to ACLs

   1. check for an explicit deny: if there is an explicit deny, then deny permission, else, check for an explicit allow
   2. check for an explicit allow: if there is an explicit allow, then allow permission
   3. if there is no explicit deny nor explicit allow, then fallback to ACLs

2. fallback to ACLs

Some examples of JSON configuration files:

Read/write access to a bucket and its objects

{
  "Statement":[{
    "Sid": "RWContainer",
    "Effect": "Allow",
    "Action":["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:GetBucketLocation"],
    "Resource":["arn:aws:s3:::<bucket_name>", "arn:aws:s3:::<bucket_name>/*"]
  }]
}

Read-only access to a bucket and its objects

{
  "Statement":[{
    "Sid": "ROContainer",
    "Effect": "Allow",
    "Action":["s3:GetObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads"],
    "Resource":["arn:aws:s3:::<bucket_name>", "arn:aws:s3:::<bucket_name>/*"]
  }]
}

Deny listing of all buckets owned by the parent account

{
  "Statement":[{
    "Sid": "DenyListBucket",
    "Effect": "Deny",
    "Action":["s3:ListAllMyBuckets"],
    "Resource":["*"]
  }]
}

Allow all operations on all project resources

{
  "Statement":[{
    "Sid": "FullAccess",
    "Effect": "Allow",
    "Action":["s3:*"],
    "Resource":["*"]
  }]
}

Read/write access to all objects in a specific folder (/home/user2) in a specific bucket (<bucket_name>)

{
  "Statement":[{
    "Sid": "RWContainer",
    "Effect": "Allow",
    "Action":["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:GetBucketLocation"],
    "Resource":["arn:aws:s3:::<bucket_name>", "arn:aws:s3:::<bucket_name>/home/user2/*"]
  }]
}

Allow all operations to specific IPs by whitelisting authorized IPs

{
  "Statement": [{
    "Sid": "ExampleStatement01",
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": [
      "arn:aws:s3:::companybucket",
      "arn:aws:s3:::companybucket/*"
    ],
    "Condition": {
      "IpAddress": {
        "aws:SourceIp": "10.0.0.5/16"
      }
    }
  }]
} 

The following policy to attempt to allow read access to objects only to specific IPs will not work under current conditions if attached to the bucket owner i.e., even if the bucket owner makes his requests from IPs that are not in the specified range, the bucket owner will be authorized.

{
  "Statement": [{
    "Sid": "ExampleStatement01",
    "Effect": "Allow",
    "Action": [
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketVersions"
    ],
    "Resource": [
      "arn:aws:s3:::<bucket_name>/*"
    ],
    "Condition": {
      "IpAddress": {
        "aws:SourceIp": "10.0.0.5/16"
      }
    }
  }]
}

The following policy to attempt to deny read access to objects to specific IPs by blacklisting unauthorized IPs will not work under current conditions if attached to the bucket owner because there is no explicit deny and requests from the specified IPs will not match the allow, therefore, we fall back to the ACLs.

{
  "Statement": [{
    "Sid": "ExampleStatement01",
    "Effect": "Allow",
    "Action": [
      "s3:GetObject",
      "s3:ListBucket",
      "s3:ListBucketVersions"
    ],
    "Resource": [
      "arn:aws:s3:::<bucket_name>/*"
    ],
    "Condition": {
      "NotIpAddress": {
        "aws:SourceIp": "10.0.0.5/16"
      }
    }
  }]
}

List of supported actions

Go further

Browse all the Object Storage (S3™-compatible) guides.

Browse the rest of the OVHcloud US documentation for guides on our other products and services.

Learn more about Object Storage on the OVHcloud US website.

If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for a custom analysis of your project.

*S3 is a trademark filed by Amazon Technologies, Inc. OVHcloud's service is not sponsored by, endorsed by, or otherwise affiliated with Amazon Technologies, Inc.