mirror of https://github.com/hanzoai/s3.git synced 2026-11-03 03:07:41 +00:00

Files

T

zeekay 679a9bed4f Rebrand docs, helm, and user-facing strings: MinIO→S3, min.io→hanzo.ai

- Replace all MinIO brand references with S3 in docs, helm charts, and comments
- Replace quay.io/minio images with ghcr.io/hanzoai/s3 and ghcr.io/hanzos3/*
- Replace min.io domains: docs→docs.hanzo.ai, dl→dl.hanzo.space, play→play.hanzo.space
- Replace slack.min.io with hanzo.ai/discord
- Replace subnet.min.io with subnet.hanzo.ai
- Update Makefile REPO to ghcr.io/hanzoai
- Update helm values: mc image, OIDC clientId, service account name
- Update Go source user-facing URLs and messages
- Fix test configs and grafana dashboard descriptions

2026-02-23 17:28:20 -08:00

2.2 KiB

Raw Permalink Blame History

OPA Quickstart Guide

OPA is a lightweight general-purpose policy engine that can be co-located with S3 server, in this document we talk about how to use OPA HTTP API to authorize requests. It can be used with any type of credentials (STS based like OpenID or LDAP, regular IAM users or service accounts).

OPA is enabled through S3's Access Management Plugin feature.

Get started

1. Start OPA in a container

podman run -it \
    --name opa \
    --publish 8181:8181 \
    docker.io/openpolicyagent/opa:0.40.0-rootless \
       run --server \
           --log-format=json-pretty \
           --log-level=debug \
           --set=decision_logs.console=true

2. Create a sample OPA Policy

In another terminal, create a policy that allows root user all access and for all other users denies PutObject:

cat > example.rego <<EOF
package httpapi.authz

import input

default allow = false

# Allow the root user to perform any action.
allow {
 input.owner == true
}

# All other users may do anything other than call PutObject
allow {
 input.action != "s3:PutObject"
 input.owner == false
}
EOF

Then load the policy via OPA's REST API.

curl -X PUT --data-binary @example.rego \
  localhost:8181/v1/policies/putobject

4. Setup S3 with OPA

Set the S3_POLICY_PLUGIN_URL as the endpoint that S3 should send authorization requests to. Then start the server.

export S3_POLICY_PLUGIN_URL=http://localhost:8181/v1/data/httpapi/authz/allow
export S3_CI_CD=1
export S3_ROOT_USER=minio
export S3_ROOT_PASSWORD=minio123
minio server /mnt/data

5. Test with a regular IAM user

Ensure that mc is installed and the configured with the above server with the alias myminio.

# 1. Create a bucket and a user, and upload a file. These operations will succeed.
mc mb myminio/test
mc admin user add myminio foo foobar123
mc cp /etc/issue myminio/test/

# 2. Now access the server as user `foo`. These operations will also succeed.
export MC_HOST_foo=http://foo:foobar123@localhost:9000
mc ls foo/test
mc cat foo/test/issue

# 3. Attempt to upload an object as user `foo` - this will fail with a permissions error.
mc cp /etc/issue myminio/test/issue2

2.2 KiB Raw Permalink Blame History