Principle of least privilege
Principle of least privilege
When assigning user permissions, minimize the scope of applicable conditions as much as possible, including reducing the number of authorized users, narrowing resource applicability, limiting authorized operations, and adding restrictive conditions for permission activation.
The Principle of Least Privilege applies to all authorization operations performed via BOS, including configuring bucket read-write permissions, setting object read-write permissions, defining IAM user access, and applying for temporary authorized access. Adhere strictly to this principle during authorization to avoid granting excessive permissions, which can pose data security risks.
FQAs
1. What is the function of AK/SK? What risks will there be if they are leaked?
AK (Access Key ID) and SK (Secret Access Key) are used to authenticate and authorize API call actions, resembling a dedicated username and password for Baidu AI Cloud API. When sending an API request, AK/SK must be used to compute a signature included in the request. Leakage of AK/SK can allow unauthorized users to improperly access BOS, increasing risks such as illegal data tampering and leakage. Be sure to safeguard your AK/SK.
2. In which scenarios is the temporary authorization service STS required?
The temporary authorization service STS is an authentication method different from the original AK/SK. It can provide users with permission to use BOS services without sharing AK/SK, featuring high access security. It is recommended to use the STS method when authorizing third-party users. Through STS, you can issue an access credential with customized validity period and permissions to third-party users. Third-party users can use this access credential to directly call Baidu AI Cloud APIs to access Baidu AI Cloud resources. For more instructions on using STS, please refer to Temporary Authorized Access.
3. How to improve data security when multiple users share a bucket?
Multi-user isolation can be achieved by partitioning a bucket. When granting permissions, allocate access only for specific paths within the bucket. For instance, when customizing bucket permissions, assign resources to user1 as Bucket1/user1_id/\ and to user2 as Bucket1/user2_id/\.
4. What is the difference between bucket coarse-grained permissions and fine-grained permissions?
In the custom bucket permission function, BOS supports users to configure a combination of coarse-grained and fine-grained permissions, and you can complete this operation through the console or API. Coarse-grained permissions are preconfigured permission templates provided by BOS. Each coarse-grained permission is a package of a set of commonly used operations, facilitating quick configuration for users. Fine-grained permissions are precise to individual API operations, providing users with the ability to strictly manage authorizations. To reduce data security risks caused by lax permission control, it is recommended to configure fine-grained permissions with allow/deny rules based on the configuration of coarse-grained permissions. For detailed information about coarse-grained/fine-grained permissions, please refer to Bucket Permission Control.