Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In Digital Ocean, S3-like space keys can access all your buckets

ideas.digitalocean.com

Post reply on HN
Print view View original

31–40 of 104 posts

Re: In Digital Ocean, S3-like space keys can access all your buckets

#31

Post by dcow »

karambir wrote: post #3
sergioisidoro wrote: post #2

S3 (and similar storages) have caused plenty of security issues in several occasions (usually because of misconfigured buckets, making all contents available to the public). Given this, it would be expected that companies would pay a bit more attention to the security of these data storage methods. However, in Digital Ocean, by design, you can't restrict keys to certain buckets. Once you issue a key, it can access al…

Things like these are why I stopped using digitalocean. They had issues with DNS PTR records too for years. Same for initial auth tokens being global. I had hopes for them and used them exclusively at 1 time.

My read on this situation is that DO is holding out until they have a comprehensive IAM solution. If you need IAM, don’t use DO. If you can live without IAM, DO is pretty nice.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#32

Post by undyingtrillion »

londons_explore wrote: post #14
sergioisidoro wrote: post #2

S3 (and similar storages) have caused plenty of security issues in several occasions (usually because of misconfigured buckets, making all contents available to the public). Given this, it would be expected that companies would pay a bit more attention to the security of these data storage methods. However, in Digital Ocean, by design, you can't restrict keys to certain buckets. Once you issue a key, it can access al…

As a user, you can fix this by having a proxy that fits in front and manages ACL's. Obviously you have to pay for resources for that proxy, and it's probably going to want a large bandwidth allocation. Lucky because DO doesn't charge for bandwidth.

This is mostly true, but there is a case where you use your transfer pool.

From their product docs:

Droplets have their own transfer allowance, independent of Spaces. Traffic from Droplets to Spaces does not count against your Spaces transfer allowance (because inbound bandwidth to Spaces is free), but does currently count against your Droplets’ outbound transfer allowance.

https://docs.digitalocean.com/products/spaces/details/pricin...

Re: In Digital Ocean, S3-like space keys can access all your buckets

#33

Post by csnweb »

turtles3 wrote: post #29

The lack of ACLs or comparable permissions is by far the biggest thing that prevents me from recommending DO for production workloads. This kind of thing is absolutely essential. You can't even separate dev resources from prod resources, every API key has godmode on your whole account. This is a security disaster. For a simple example, I'm running externaldns on a kubernetes cluster. For production use, I'd want to a…

I agree, probably the biggest point Digitalocean is lacking. I think the only workaround is creating several projects? But that probably becomes annoying and hard to manage quite easily if you want a lot of separation.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#34

Post by richbell »

neom wrote: post #28
belter wrote: post #19

Earlier quoted context omitted.

Some of the comments by DO on that GitHub thread, are really surprising, and disappointing to say the least...

I wrote those comments, fog wasn't using the API as he would have liked, and then this guy starts a bunch of trouble on HN stating that there was a vun on DigitalOcean, and conflated someone using the API incorrectly with us having a security vun. Two things I was trying to (admittedly not very well) say was: if DO did have a security issue, posting it on HN ("DigitalOcean leaks customer data between VMs" huh?) inste…

I do find the claim that "there's nothing irresponsible about full immediate disclosure" to be interesting.

https://github.com/fog/fog/issues/2525#issuecomment-31336855

Re: In Digital Ocean, S3-like space keys can access all your buckets

#35

Post by dcow »

Operyl wrote: post #11
k8sToGo wrote: post #10

Earlier quoted context omitted.

Isn't this usually solved through some form of IAM policies? Does DO not have this?

No such luck there, but this is kind of the MO for DigitalOcean, sadly.

I think DO is doing fine addressing their target market. I also wish they had IAM but you have to admit IAM is huge and messy and is often more about managing your employees than your infrastructure. I’m okay waiting for them to get it right rather than rushing out a quick half baked idea that ruins their entire product stack err platform.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#37

Post by sergioisidoro »

fulafel wrote: post #25

Click saver: this is about access keys, not bucket keys. (Which would have been in the original title...)

The point is that there are no bucket keys. Only Access keys for all buckets. There is no way to issue bucket specific keys. I'm not sure I follow how the title could be misleading.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#38

Post by sergioisidoro »

drogus wrote: post #36

Wait till you hear that when you generate a DO container registry key it includes a key that gives you access to all of the resources, not only the registry.

Are you saying you have to issue a "god" level API access token to access a single docker (private) image in the Digital Ocean container registry?

Re: In Digital Ocean, S3-like space keys can access all your buckets

#39

Post by giancarlostoro »

snowstormsun wrote: post #5

And DO consistently ignores requests to add this. It prevents me from seriously using Spaces and I think many others, too.

Yeah I was unaware of this, and will no longer consider DO for anything beyond basic VPS hosting, if even that.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#40

Post by ratg13 »

neom wrote: post #28
belter wrote: post #19

Earlier quoted context omitted.

Some of the comments by DO on that GitHub thread, are really surprising, and disappointing to say the least...

I wrote those comments, fog wasn't using the API as he would have liked, and then this guy starts a bunch of trouble on HN stating that there was a vun on DigitalOcean, and conflated someone using the API incorrectly with us having a security vun. Two things I was trying to (admittedly not very well) say was: if DO did have a security issue, posting it on HN ("DigitalOcean leaks customer data between VMs" huh?) inste…

The fact that you think it should be the customers’ responsibility to make sure that DO doesn’t accidentally give your private data away to unknown third parties is an absolutely minblowing take on this matter.

I’ve been a DO customer for the better part of a decade, but there is no way that I can continue to be a customer with a company that has such a blasé stance toward security and protecting customer data.

If anyone can suggest any alternatives that are not Hetzner, I would be interested.

Post reply on HN