Description
Ensure Object Storage users are given only the access they need, for example read-only access to one bucket, rather than administrator access to all buckets. Custom user policies can be used to limit actions and buckets.
Rationale
Object Storage users have S3 credentials that are often stored in applications and scripts. A user with administrator rights can read, change, or delete every bucket, so a leaked credential could expose or destroy all stored data. Limiting each user to the buckets and actions it needs reduces this risk.
Impact
Limits damage from leaked S3 credentials
Each application gets only the access it needs
Applications may need new users with narrower rights
Default Value
When a user is created, a role must be chosen, and administrator access can be granted.
Pre-Requisites
Permission to manage Object Storage and users in the Public Cloud project
Test Plan
Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.
In the left-hand menu, select Public Cloud and choose your project.
In the left-hand menu, select Object Storage.
Open the Object Storage Users tab and review each user's role or policy.
Flag users with administrator access, or access to buckets they do not need.
If any are found, follow the implementation steps.
Implementation Steps
Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.
In the left-hand menu, select Public Cloud and choose your project.
In the left-hand menu, select Object Storage.
Open the Object Storage Users tab and, for the user, select the option to import or edit its policy.
Apply a policy that allows only the needed actions on the needed buckets, for example s3:GetObject and s3:ListBucket on one bucket.
Confirm that the application still works.
Backout Plan
Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.
In the left-hand menu, select Public Cloud and choose your project.
In the left-hand menu, select Object Storage.
Re-apply the previous role or policy to the user.
Reference