Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In Digital Ocean, S3-like space keys can access all your buckets

ideas.digitalocean.com

Post reply on HN
Print view View original

61–70 of 104 posts

Re: In Digital Ocean, S3-like space keys can access all your buckets

#61

Post by [deleted] »

Operyl wrote: post #53
dcow wrote: post #35

Earlier quoted context omitted.

I think DO is doing fine addressing their target market. I also wish they had IAM but you have to admit IAM is huge and messy and is often more about managing your employees than your infrastructure. I’m okay waiting for them to get it right rather than rushing out a quick half baked idea that ruins their entire product stack err platform.

I don't care for the full on flexibility of IAM, but I'd kill for a simple "this key is for this bucket" feature. That doesn't seem so far fetched, I don't need per-object permissions within a single bucket!

[deleted]

Re: In Digital Ocean, S3-like space keys can access all your buckets

#62

Post by supriyo-biswas »

nik736 wrote: post #22
slig wrote: post #21

Why the smaller players can't figure this out? Are they inventing their own S3-compatible storage or using a open source project underneath if?

They are all using Ceph, which is the limitation.

This is correct, Ceph's RadosGW doesn't support this feature.

For people trying to figure out if their provider is using Ceph, make a request for /test" rel="nofollow noreferrer">https:///test and see if the x-amz-request-id header begins with "tx000", if it does, then they're using Ceph.

$ curl -sSi https://nyc3.digitaloceanspaces.com/test/ | grep x-amz-request-id

x-amz-request-id: tx00000947bc21a401c0f02-00651981d1-4b6a0-nyc3d

Re: In Digital Ocean, S3-like space keys can access all your buckets

#64

Post by ratg13 »

neom wrote: post #56
ratg13 wrote: post #52

Earlier quoted context omitted.

Imagine if your bank told you they only close the vault when a customer asks. And they give you an excuse that it’s time consuming for them and you should respect their time. Would you bank with them? This is a pathetic response and you are dragging your former company through the mud by putting the incompetence that you participated in, front and center. It’s amazing that this happened so long ago and yet you seemed…

I was always very clear at that time "this is a startup" - "do not use DO for mission critical work" - "the product is not very mature yet" - we had no sales team, nothing in our marketing was gear towards business and we primarily catered to students/personal sites/etc. I'd accept your analogy except we regularly said "use AWS for important stuff, not us".

Even startups have to follow the law.

Before the GDPR the EU had the 1995 Data Protection Directive, which you would have to comply with to have EU customers.

You can’t just decide to not follow the law because you’re a startup.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#65

Post by dijksterhuis »

drogus wrote: post #49
dijksterhuis wrote: post #44

Earlier quoted context omitted.

The permissions options on the API key are read or write for the whole project. There is basically no granularity.

It's not about the API key. It's about the container registry credentials. Which you would expect to be able to only interact with the container registry. This is not the case. If you go to the container registry and click to download credentials you will get JSON like: {"auths":{"registry.digitalocean.com":{"auth":" "}}} If you decode the base64 encoded credentials it will be a string like " : " with either a read o…

> It's not about the API key. It's about the container registry credentials. Which you would expect to be able to only interact with the container registry.

think my reply shortness maybe has you misunderstanding me?

The fact that an API token can only have read/write project wide basically results in everything you said.

No RBAC on services. No RBAC on specific API actions. Anyone with read+write can do/nuke everything.

That’s why I’m migrating $COMPANY off to AWS as fast as I humanly can by myself.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#68

Post by [deleted] »

csnweb wrote: post #33
turtles3 wrote: post #29

The lack of ACLs or comparable permissions is by far the biggest thing that prevents me from recommending DO for production workloads. This kind of thing is absolutely essential. You can't even separate dev resources from prod resources, every API key has godmode on your whole account. This is a security disaster. For a simple example, I'm running externaldns on a kubernetes cluster. For production use, I'd want to a…

I agree, probably the biggest point Digitalocean is lacking. I think the only workaround is creating several projects? But that probably becomes annoying and hard to manage quite easily if you want a lot of separation.

[deleted]

Re: In Digital Ocean, S3-like space keys can access all your buckets

#69

Post by pizzafeelsright »

slig wrote: post #21

Why the smaller players can't figure this out? Are they inventing their own S3-compatible storage or using a open source project underneath if?

Painful, slow, costly.

Access request needs to be created, validated, logged, processed, expired or revoked.

Or just validated, processed, and logged.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#70

Post by neom »

ratg13 wrote: post #64
neom wrote: post #56

Earlier quoted context omitted.

I was always very clear at that time "this is a startup" - "do not use DO for mission critical work" - "the product is not very mature yet" - we had no sales team, nothing in our marketing was gear towards business and we primarily catered to students/personal sites/etc. I'd accept your analogy except we regularly said "use AWS for important stuff, not us".

Even startups have to follow the law. Before the GDPR the EU had the 1995 Data Protection Directive, which you would have to comply with to have EU customers. You can’t just decide to not follow the law because you’re a startup.

What law would cover this??
Post reply on HN