Skip to content
Sign in

Access keys and signing

Every S3 request is signed with an access key: an ID (public, starts with SW) and a secret (private). SwiftFS stores secrets encrypted and never shows them again after creation.

Creating keys

In SwiftFS Cloud, open Access keys in the console:

  • Description: what the key is for, so you can tell keys apart later.
  • Buckets: all of the organization's buckets, or only the ones you pick.
  • Read-only: lists and downloads only, no writes or deletes.
  • Expiry: optional; the key stops working after it.

The secret is shown once, with ready-made configuration for the AWS CLI, environment variables and the JavaScript SDK.

Keys belong to the member who creates them. Developers manage their own; owners and admins see and revoke everyone's. Viewers can't create keys. A member who leaves, or is made a viewer, loses their keys at once.

When self-hosting, create keys with the command line:

Terminal
swiftfs admin key create --account acme --description "web app"
swiftfs admin key create --account acme --bucket reports --read-only --description "BI export"

Revoking keys

Revoke a key from the console (or swiftfs admin key revoke KEY_ID). Requests signed with it are refused within 15 seconds. Other keys are not affected.

One key per application makes this painless: when a laptop is lost or a service is retired, you revoke only its key.

Signing requests

SDKs and tools sign for you once they have the key, the endpoint and the region. SwiftFS accepts AWS Signature Version 4 in the Authorization header, with the payload signed, unsigned, or streamed in signed chunks or with trailing checksums, as the AWS SDKs send them.

Presigned URLs

A presigned URL carries its signature in the query string, so whoever holds it can make that one request (a download or an upload) without a key, until it expires. Lifetimes go up to 7 days.

Terminal
# A download link valid for an hour:
aws --endpoint-url "$S3_ENDPOINT" s3 presign s3://acme-media/report.pdf --expires-in 3600

For uploads from a browser, your server creates a presigned PUT. See browser uploads.

A presigned URL acts with the key that signed it: revoking the key cancels its URLs too. Links made in the console are signed by SwiftFS for the console and simply expire.

Anonymous requests

Requests without a signature are refused, unless a bucket policy allows them, for example to serve public media.