Access management methods in Object Storage: Overview

Object Storage uses various access management methods:

• Yandex Identity and Access Management (IAM)
• Access control list (ACL)
• Bucket policy
• Public access
• Security Token Service
• Pre-signed URLs
• VPC service connections

Also, enabled encryption may affect access to buckets and objects in Object Storage. For more information about working with encrypted buckets, see Encryption in Object Storage.

The flow chart below shows how these access management methods work together in Object Storage.

The checks follow this algorithm:

1. IAM and bucket ACL:
   • If the request passes the IAM or bucket ACL check, it is checked whether the bucket policy is configured.
   • If the request fails the IAM and bucket ACL checks, it is checked whether public access to the bucket is enabled.
2. Public access:
   • If public access to perform the action is enabled, it is checked whether the bucket policy is configured.
   • If public access to perform the action is denied, an access check based on the object ACL is performed.
3. Bucket policy:
   • If the bucket policy is configured:
     1. If the request meets at least one of the Deny rules in the bucket policy, an access check based on the object ACL is performed.
     2. If the request meets at least one of the Allow rules in the bucket policy, it is checked whether there is access via Security Token Service.
     3. If the request does not meet any of the bucket policy rules, an access check based on the object ACL is performed.
   • If the bucket policy is not configured, it is checked whether there is access via Security Token Service.
4. Security Token Service:
   • If the request is made using Security Token Service:
     1. If the request meets at least one of the Deny rules in the policy for the temporary key, an access check based on the object ACL is performed.
     2. If the request meets at least one of the Allow rules in the policy for the temporary key, access will be allowed.
     3. If the request does not meet any of the policy rules for the temporary key, an access check based on the object ACL is performed.
   • If the request is made directly, access will be allowed.
5. Object ACL:
   • If the request passes the object ACL check, access will be allowed.
   • If the request fails the object ACL check, access will be denied.

Identity and Access ManagementIdentity and Access Management

Identity and Access Management is a main method for managing access in Yandex Cloud using roles. It enables the basic access control policy. For more details, see Which roles exist in the service.

Access grantees:

• Yandex account
• Service account
• Federated user
• System group
• Public group

Access is granted for a cloud, folder, or bucket.

Access control list (ACL)Access control list (ACL)

An access control list (ACL) is a list of action permissions stored directly in Object Storage. It enables the basic access control policy. ACL permissions for buckets and objects are different; see Permission types for details.

Access grantees:

• Yandex account
• Service account
• Federated user
• System group
• Public group

Access is granted for a bucket or object.

Bucket policyBucket policy

A bucket policy is a list of rules that prohibit or allow actions when certain conditions are met. It allows you to granularly differentiate access to buckets, objects, and groups of objects.

Access grantees:

• Yandex account
• Service account
• Federated user
• Anonymous user

Access is granted for a bucket, object, or a group of objects.

Public accessPublic access

Public access defines access permissions for anonymous users to read objects, list of objects, and bucket settings.

Access is granted for a bucket.

Security Token ServiceSecurity Token Service

Security Token Service is an Identity and Access Management component to get temporary access keys compatible with AWS S3 API.

With temporary keys, you can set up granular access to buckets for multiple users with a single service account.

Pre-signed URLsPre-signed URLs

Pre-signed URLs are a way of giving anonymous users temporary access to certain actions in Object Storage using URLs that contain request authorization data in their parameters.

Access is granted for a bucket or object.

VPC service connectionsVPC service connections

To make Object Storage buckets accessible from VPC cloud networks directly, use a VPC service connection. With this connection, you can access Object Storage via VPC internal IP addresses without any Internet access.

In Object Storage, you can configure your bucket so that it is only accessible via VPC service connections. The following mechanisms are provided:

• Policy-level bucket access restriction: Bucket can be accessed from VPC service connections with IDs specified in the policy. However, as the flow chart shows, the bucket will still be accessible from the public network, e.g., though an object ACL or under another enabling rule in the policy. In addition, a bucket configured this way still supports server-side copy, both from and to the bucket. For more information, see Configure a bucket policy for access from service connections.
• Service-level bucket access restriction: Bucket can be accessed only from VPC service connections. Remember to specify particular names of connections. The bucket will not be accessible from the public network. This mechanism, as currently implemented, also blocks access to the bucket from the management console. For more information, see Configure a restriction for access only from service connections.

Server-side copyServer-side copy

For details on server-side copy in buckets with access restricted to VPC service connections, refer to this table:

Source bucket	Target bucket	Condition to initiate server-side copying1
Access restricted to VPC service connections	Access restricted to VPC service connections	Request from a service connection listed as allowed for both buckets
Access restricted to VPC service connections	Access from a public network	Request from a service connection listed as allowed for the source bucket
Access from a public network	Access restricted to VPC service connections	Request from a service connection listed as allowed for the target bucket
Access from a public network	Access from a public network	Request from a public network or service connection

¹ If the client has permissions to read from the source bucket and write to the target bucket.

See alsoSee also

• Configuring access permissions for a bucket using Identity and Access Management
• Editing a bucket ACL
• Editing an object ACL
• Managing a bucket policy
• Configuring public access to a bucket
• Accessing a bucket using Security Token Service
• Accessing a bucket using a service connection from Yandex Virtual Private Cloud