Skip to main content

​
Overview

Object Storage security covers the proxy-layer communication security, temporary URL key management, audit logging, and governance of cross-project container sharing. This guide covers the key hardening areas for platform administrators.
Administrator Access Required — This operation requires the admin role. Contact your Polystack administrator if you do not have sufficient permissions.

​
Hardening Guidelines

TLS enforcement on proxy nodes

All proxy-server endpoints must use TLS:
  • Configure the proxy-server with SSL certificates issued through Polystack Key Manager
  • Disable plain HTTP access at the load balancer frontend — redirect all port 80 traffic to 443
  • Set HSTS headers in the proxy pipeline:
  • Rotate TLS certificates 30 days before expiration using an automated renewal workflow
  • Verify TLS configuration after every certificate rotation:
    Verify TLS certificate on proxy endpoint
Temporary URLs are signed with an account-level key. Compromise of this key allows generation of arbitrary temporary URLs for all objects in the account:
  • Use randomly generated keys of at least 32 bytes
  • Rotate the Temp-URL-Key quarterly:
    Rotate temp URL signing key
  • Set Temp-URL-Key-2 as a secondary key during rotation to avoid invalidating existing in-flight URLs immediately:
    Set secondary temp URL key for rotation overlap
The proxy-server logs every API request including the authenticated user, container, object path, HTTP method, and response code. Configure log forwarding with:
  • 90-day minimum retention for compliance frameworks
  • Alerting on unusual patterns:
    • Mass object deletions
    • Access from unexpected source IPs
    • Spike in 4xx errors indicating credential scanning
  • Storage of logs in a separate protected container — restrict write access to the proxy log-shipping service account only
Cross-project container sharing via ACLs requires careful governance:
  • Audit all containers with non-empty read or write ACLs quarterly:
    Find containers with ACLs (admin)
  • Require documented business justification for any cross-project ACL
  • Immediately revoke ACLs for decommissioned projects
  • Never grant write ACLs to external user IDs — use dedicated service accounts traceable to a specific application

​
Security Checklist

​
Next Steps

Quotas

Enforce per-account and per-container storage limits

Monitoring

Set up cluster health and access pattern monitoring

Key Manager Admin Guide

Manage TLS certificates used by proxy nodes

Admin Troubleshooting

Diagnose security-related access errors