Managing S3 users

The concept of an S3 user is one of the base concepts of object storage along with those of an object and a bucket (a container for storing objects). The Amazon S3 protocol uses a permission model based on access control lists (ACLs), where each bucket and each object are assigned an ACL that lists all users with access to the given resource and the type of this access (read, write, read ACL, or write ACL). The list of users includes the entity owner assigned to every object and bucket at creation. The entity owner has extra rights compared to other users. For example, the bucket owner is the only one who can delete that bucket.

User model and access policies implemented in Virtuozzo Hybrid Infrastructure comply with the Amazon S3 user model and access policies.

User management scenarios in Virtuozzo Hybrid Infrastructure are largely based on the Amazon Web Services user management and include the following operations: create, query, and delete users, as well as generate and revoke user access key pairs.

Managing S3 access key pairs

Each S3 user has one or two key pairs (access key and secret key) for accessing the S3 cloud. You can think of the access key as the login and the secret key as the password. (For more information about S3 key pairs, refer to the Amazon documentation.) The access keys are generated and stored locally in the storage cluster on S3 name servers. Each user can have up to two key pairs. It is recommended to periodically revoke old access key pairs and generate new ones.

To access a bucket, a user needs the following information:

• Admin panel IP address
• DNS name of the S3 cluster specified during configuration
• S3 access key ID
• S3 secret access key
• SSL certificate if the HTTPS protocol was chosen during configuration (the certificate file can be found in the /etc/nginx/ssl/ directory on any node hosting the S3 gateway service)

Prerequisites

• S3 users are created, as described in Adding S3 users.
• A clear understanding of the best S3 practices, listed in Best practices for using S3 in Virtuozzo Hybrid Infrastructure.

To view, add, or revoke the S3 access key pairs for an S3 user

Select a user in the list, and then click Keys:

• View the existing keys on the Keys pane.
• To revoke a key, click Revoke.
• To add a new key, click Generate access key.