In Digital Ocean, S3-like space keys can access all your buckets

Post by supriyo-biswas » Sun, Oct 01, 2023, 7:25 PM UTC

vlovich123 wrote: post #73

supriyo-biswas wrote: post #59

Earlier quoted context omitted.

That is a limitation that comes along with having to be S3 compatible; the best you can do is to combine ListObjectsV2[1] + DeleteObjects[2] (1000 objects in a single API call). [1] https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObje... [2] https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteOb...

While S3 doesn’t have a REST API to do it, you can trigger it through the console and it applies pretty quickly if you don’t have a lot of objects (hundreds of thousands if I recall correctly) and will apply in the background otherwise. The way to do it via the s3 API is to install a lifecycle policy to delete everything.

Post by dijksterhuis » Sun, Oct 01, 2023, 10:36 PM UTC

drogus wrote: post #89

dijksterhuis wrote: post #65

Earlier quoted context omitted.

> It's not about the API key. It's about the container registry credentials. Which you would expect to be able to only interact with the container registry. think my reply shortness maybe has you misunderstanding me? The fact that an API token can only have read/write project wide basically results in everything you said. No RBAC on services. No RBAC on specific API actions. Anyone with read+write can do/nuke everyth…

Ok, I see what you mean. Still, even knowing that general access tokens are all or nothing it was surprising that exactly the same thing was used for containers. Like, if you generate a separate credentials for containers it strongly suggests there are for containers only.