Private Endpoints in Object Storage

Use policies to limit access to Object Storage private endpoints. A policy specifies who can access Oracle Cloud Infrastructure resources and how. For more information, see How Policies Work.

Assign a group the least privileges that are required to perform their responsibilities. Each policy has a verb that describes what actions the group is allowed to do. Each policy has a verb that describes what actions the group is allowed to do. From the least amount of access to the most, the available verbs are: inspect, read, use, and manage.

The following permissions are required to perform the corresponding operations:

Allow group groupName to manage objectstorage-private-endpoint in tenancy
Allow group groupName to manage virtual-network-family in tenancy

We recommend the following IAM policies be added to allow Object Storage private endpoint management:

allow group groupName to manage objects in tenancy where all {target.bucket.name = 'bucketName', request.network.source = 'networkSourceName'}

The following limits apply to private endpoints in Object Storage:

• You can use a maximum of 10 private endpoints within a tenancy.

• You can use up to 10 access targets for each private endpoint.

• Each private endpoint has a maximum bandwidth of 25 Gbps.

When creating pre-authenticated requests (PARs) through private endpoints, note the following points:

• The PAR has the private endpoint fully-qualified domain name (FQDN) as part of the PAR URL.

• You can create a PAR through the private endpoint on buckets that are allowed by Access Targets only.

• You can access PAR buckets and objects from the public endpoint as well by replacing the private endpoint FQDN in the URL with the public endpoint.

For more information, see Pre-Authenticated Requests.

After you create an Object Storage private endpoint, it becomes usable. The fully-qualified domain names (FQDNs) that are created from the DNS prefix input become resolvable by the private DNS zone within the VCN. These FQDNs become the endpoint that are used in requests to Object Storage to ensure the requests go through the private endpoint.

Here is an example of how the FQDNs appear in the CLI-based details of a private endpoint:

oci os private-endpoint get --pe-name pe1
                 
{
  "data": {
    "access-targets": [
      {
        "bucket": "*",
        "compartment-id": "*",
        "namespace": "MyNamespace"
      }
    ],
    "additional-prefixes": [],
    "compartment-id": "ocid1.tenancy.oc1..exampleuniqueID",
    "created-by": "ocid1.user.region1..exampleuniqueID",
    "defined-tags": {},
    "etag": "017e1d8f-1013-477a-86a4-d4d03b473f74",
    "fqdns": {
      "additional-prefixes-fqdns": {},
      "prefix-fqdns": {
        "object-storage-api-fqdn": "pe1-MyNamespace.private.objectstorage.us-phoenix-1.oci.customer-oci.com",
        "s3-compatibility-api-fqdn": "pe1-MyNamespace.private.compat.objectstorage.us-phoenix-1.oci.customer-oci.com",
        "swift-api-fqdn": "pe1-MyNamespace.private.swiftobjectstorage.us-phoenix-1.oci.customer-oci.com"
      }
    },
    "freeform-tags": {},
    "id": "ocid1.privateendpoint.region1.sea.exampleuniqueID",
    "lifecycle-state": "ACTIVE",
    "name": "pe1",
    "namespace": "MyNamespace",
    "nsg-ids": [],
    "prefix": "pe1",
    "private-endpoint-ip": "10.0.0.2",
    "subnet-id": "ocid1.subnet.region1.sea.exampleuniqueID",
    "time-created": "2024-06-20T06:33:56.866000+00:00",
    "time-modified": "2024-06-20T06:36:01.820000+00:00"
  },
  "etag": "017e1d8f-1013-477a-86a4-d4d03b473f74"
}

Here is an example getting details of an object using one of the FQDNs you created using the CLI:

oci os object get --namespace 'MyNamespace' --bucket-name 'MyBucket' --name MyObjectName --endpoint https://pe1-MyNamespace.private.objectstorage.us-phoenix-1.oci.customer-oci.com

To help ensure secure, private connectivity to Object Storage, we recommend the following best practices when using private endpoints:

1. You must allow ingress for port 443 using one of the following methods:

   • Adding a security list rule in the default security list. This security rule is applied to all VNICs in the subnet. See Security Lists for more information.

   • Creating a network security group (NSG) with the ingress' security list rule, and then including the NSG in the private endpoint creation. This NSG is only applied to the private endpoint. See Network Security Groups for more information. We recommend using this method as it provides a greater level of secuirty.

2. To avoid data exfiltration across tenancies, begin with an access target configured such as namespace = your_namespace, compartment = *, bucket = *. This configuration allows the private endpoint to access all buckets in all compartments in your namespace.

3. To further restrict access to only one or more buckets that can be accessed by the private endpoint, begin with an access target configured such as namespace = <your_namespace>, compartment = Compartment1, bucket = Bucket1. You can specify up to 10 buckets using access targets.

4. Use IAM polices on the bucket, so requests are only authorized if they originate from a specific VCN or a CIDR block within that VCN. All other access, including over the internet, is blocked to these buckets. See Managing Network Sources for more information.

   The following is a sample policy to restrict a specific bucket to a specific network source:

   allow group groupName to manage objects in tenancy where all {target.bucket.name = 'bucketName', request.network.source = 'networkSourceName'}

5. One or more private DNS zones are created in the VCN during the creation of a private endpoint. This private DNS zone helps resolve the private endpoint fully-qualified domain name to the private IP address of the private endpoint. When using private endpoints, we recommend not to change DNS entries in the private DNS zone of the VCN. Changing these can affect the behavior of traffic and requests flowing through the private endpoint.

6. To delete a subnet or VCN that contains a private endpoint, we recommend you delete the private endpoint before deleting the subnet or VCN.