Cephalocon 2019

A large number of leaks in S3 are caused by users accidentally setting their
buckets to public. Find out the various possibilities RGW already offers for
securing your objects, as an end user. There is support for S3 APIs for
encryption, lifecycle (+tiering in Nautilus) and Bucket & User Policies , in RGW, which offer fine
grained control on access to your objects, much more than simple ACLs.

The Bucket Policy definition is almost a full language in its own right, we'll
walk through some policies for securing your objects. For eg what if you wanted to share only the images in your bucket, restricted to certain tags but only for specific users or source ips? Or if you want objects to expire after a certain time? Policies for these kind of actions are already available to end users allowing for fine grained policies on objects meant to be shared.