Overview
The EU DataVault Storage Console (EDSC) is an enterprise-grade cloud storage management tool that offers Identity and Access Management (IAM). This feature enables Role-Based Access Management (RBAC) for securing your storage and complying to data governance rules and regulatory requirements.
The EU DataVault Storage is S3 compatible and is built based on the industry-standard. Thus, users can expect the underlying IAM features to be similar to what they are accustomed to. The EU DataVault Storage's IAM features can be configured through the Storage Console (GUI) as well as using the AWS IAM API.
Users, Policies, and Groups
There are three main concepts that should be considered when using EU DataVault Storage's IAM features: Users, Policies, and Groups - each with a dedicated tab in the GUI.
User: A specific account with a dedicated login mail and password. This can either be a root user or a sub-user. A user represents an individual that can access the EU DataVault Storage Console. For instance, an employee in a marketing department.
Currently, every organization will receive one root user with the ability to manage identity and access for their organization.
Policy: A set of permissions defining what individuals can see and do. These rules are defined on a group level, which consists of dedicated users. For instance, this could comprise of permissions for the marketing department to access marketing-relevant content.
Group: A representation of an organizational unit comprising of user accounts assigned to selected policies. For instance, this could be a marketing department.
Supported IAM Features
To provide true S3 compatibility, our object storage supports all S3 actions and effects. This means that permissions can be assigned at the most granular level. For instance:
List: Shows a list of buckets authorized for the respective group. This is a minimum requirement for any sub-user in that group to see the assigned buckets.
Read: This allows the assigned group's sub-users to retrieve objects with their previous versions and configurations (e.g. object lock status, retention periods, and legal hold status).
Write: This allows sub-users of the assigned group to delete and/or add an object to a bucket.
Refer to AWS documentation on S3 actions and effects for more details.