The page has been translated by Gen AI.

Access control

When you enable access control on a bucket, only resources that are granted permission can access the bucket. You can enter a public IP, or configure settings to allow access to resources created in the Samsung Cloud Platform Console.

Setting Access Control

You can set the bucket’s access control to enabled.

Object Storage Follow the steps below to configure access control settings.

  1. Click the All Services > Storage > Object Storage menu. 1. Go to the Service Home page.
  2. On the Service Home page, click the Object Storage menu. 2. Navigate to the Object Storage List page.
  3. Object Storage List On the page, click the resource (bucket) for which you want to set access control. 3. Go to the Object Storage Details page.
  4. On the Object Storage Details page, verify that Access Control is unused.
  5. If Access control is unused, click the Edit button. 5. Edit Access Control The popup window opens.
  6. Check the use of access control, then click the confirm button. 6. On the Object Storage Details page, Access Control will be changed to enabled.
    • If you change access control to Enabled, you can set access control for Public IP, Service Resources and Cloud Functions, Simple AI Training service.
  7. Click the Edit button of the resource or service you want to allow access to, and add resources or set the permission status.
    CategoryDetailed description
    Allow public IPRegistered Public IP or CIDR list
    • Example: 192.168.x.x, 192.168.x.x/24
    Allow service resourcesList of service resources created in the same Account/region
    • Service examples: Virtual Server, GPU Server, Bare Metal Server, Multi-node GPU Cluster, VPC Endpoint, PostgreSQL, MariaDB, MySQL, EPAS, Microsoft SQL Server
    Cloud Functions serviceSpecifies whether to allow Object Storage access for modifying Java Runtime code in the Cloud Functions service.
    • When set to Allow, the Cloud Functions service can load Java Runtime executable files stored in Object Storage.
    Simple AI Training ServiceSet whether to allow Object Storage access for retrieving the Training Script in the Simple AI Training service
    • Allow when set, the Simple AI Training service can retrieve the Training Script stored in Object Storage
    Table. Access control items
Reference
  • When access control is set to unused, it is applied as full allow.
  • If you modify the access permission, it may take up to 30 seconds for the changes to be applied.
Reference
Access between Object Storage and Samsung Cloud Platform resources is supported only through the access control on the Object Storage detail screen.
Please note that when IP access control is used in an IAM policy, access between Object Storage and SCP resources is not possible.
To use the service, set the IAM policy with Applied IP: All IPs and Excluded IP: Not used.
guide

South Korea (kr-south) region constraints

  • The South Korea (kr-south) region does not provide Cloud Functions service, so the Allow Cloud Functions service feature cannot be used.

Allow Public IP Access

If the bucket’s access control is set to enabled, you can add a public IP allowance. To add Public IP access permission in Object Storage, follow the steps below.

  1. All Services > Storage > Object Storage Click the menu. 1. Navigate to the Service Home page.

  2. Click the Object Storage menu on the Service Home page. 2. Go to the Object Storage List page.

  3. Object Storage List page, click the resource (bucket) you want to configure access control for. 3. Go to the Object Storage Details page.

  4. On the Object Storage Details page, verify that access control is enabled.

    • If Access Control is disabled, click the Edit button, then in the Access Control popup, change Access Control to enabled.
    • You can control access to IP access, service resource, Cloud Functions service, and Simple AI Training service only when access control is enabled.

  5. Click the Edit button in Public IP Allow. 5. Edit Public IP Allow The popup window opens.

  6. Enter the Public IP to allow access, and click the Add button. 6. The entered IP is displayed in the IP to add list.

    columnrequiredDetailed description
    Allow public IPrequiredEnter a single IP or CIDR format
    • 192.168.x.x (IP format)
    • 192.168.x.x/24 (CIDR format)
    • Up to 150 entries can be entered
    Table. Public IP Allowance Edit Popup Input Fields

  7. IP to add After checking the list, press the Confirm button.

  8. On the Object Storage Details page, verify the added Public IP in the Access Control > Allow Public IP list.

reference
  • Modifying the public IP allowance can take up to 30 seconds for the changes to be completed.
  • Up to 150 public IPs are allowed.

Allow access to service resources

If access control is set to enabled for the bucket, you can add service resources in the service resource allowance. Follow these steps to allow access to service resources from Object Storage.

  1. Click the All Services > Storage > Object Storage menu. 1. Navigate to the Service Home page.
  2. Click the Object Storage menu on the Service Home page. 2. Go to the Object Storage List page.
  3. On the Object Storage List page, click the resource (bucket) for which you want to set access control. 3. Object Storage Details Navigate to the page.
  4. On the Object Storage Details page, verify whether Access Control is enabled.
    • If Access Control is Not Used, click the Edit button, then in the Access Control popup, change Access Control to Enabled.
    • You can control access to IP access allowance, service resource allowance, Cloud Functions service, Simple AI Training service only when access control is enabled.
  5. Click the Edit button in Service Resource Allowance. 5. Service Resource Selection popup opens.
  6. Service Resource Selection In the popup window, select the service to grant access to, then choose the resources to allow.
Notice

  • The permissible criteria for each service are as follows.

    • Virtual Server/GPU Server/Bare Metal Server/Multi-node GPU Cluster: Allowed per server
    • VPC Endpoint: Allow per VPC Endpoint
    • PostgreSQL, MariaDB, MySQL, EPAS, Microsoft SQL Server: Allowed per cluster

  • To access Object Storage from the server, you must first perform the following steps.

    1. Check the Object Storage IP on the server using the nslookup command.
    2. Register a rule through the Security Group or Firewall service and apply it to the server.
      • Target address: Object Storage IP confirmed in step 1
      • Direction: Outbound
      • Service : TCP 80, 443 (use 80 for http / use 443 for https)
Caution

If the status of each service is as follows, granting and revoking access to service resources is possible. If it is not in the following state, the previously authorized service resources may also be affected.

  • Virtual Server/GPU Server: Build, Building, Networking, Scheduling, Block_Device_Mapping, Spawning, Deleting, Error and other states
  • Bare Metal Server/Multi-node GPU Cluster: Running, Starting, Stopped
  • VPC Endpoint: Active
  • PostgreSQL/MariaDB/MySQL/EPAS/Microsoft SQL Server: Running
  1. When you have finished selecting the resources to allow access, press the Confirm button.
  2. Check the resources you added in the Access Control > Service Resource Allow list on the Object Storage Details page.
Reference
  • Modifying the service resource allowance may take up to 30 seconds for the changes to be completed.
  • Service resources are allowed up to a maximum of 150.

Allow access to Cloud Functions

If access control on the bucket is set to enabled, you can allow the Cloud Functions service to access Object Storage.

Follow these steps to allow access to the Cloud Functions service from Object Storage.

  1. Click the All Services > Storage > Object Storage menu. 1. Navigate to the Service Home page.
  2. Click the Object Storage menu on the Service Home page. 2. Go to the Object Storage List page.
  3. On the Object Storage List page, click the resource (bucket) for which you want to set access control. 3. Object Storage Details Navigate to the page.
  4. On the Object Storage Details page, confirm that access control is enabled.
    • If Access Control is Not Used, click the Edit button, then in the Access Control popup, change Access Control to Enabled.
    • You can control access to IP Access Allowance, Service Resource Allowance, Cloud Functions Service, and Simple AI Training Service only when access control is enabled.
  5. Click the Edit button of the Cloud Functions service. 5. Edit Cloud Functions service A popup window opens.
  6. After checking Allow, click the Confirm button.
Reference
  • Once the access permission settings for the Cloud Functions service are completed, the Cloud Functions service can retrieve the Java Runtime executable stored in Object Storage.
  • Refer to Java Runtime 코드 변경하기 for how to load the Java Runtime executable in the Cloud Functions service.
Reference

South Korea (kr-south) region constraints

  • The South Korea (kr-south) region does not provide Cloud Functions service, so the Allow Cloud Functions Service feature cannot be used.

Allow access to Simple AI Training service

If access control on the bucket is set to enabled, you can allow the Simple AI Training service to access Object Storage.

To allow access to the Simple AI Training service from Object Storage, follow these steps.

  1. Click the All Services > Storage > Object Storage menu. 1. Navigate to the Service Home page.
  2. Click the Object Storage menu on the Service Home page. 2. Go to the Object Storage List page.
  3. On the Object Storage List page, click the resource (bucket) for which you want to set access control. 3. Object Storage Details page.
  4. On the Object Storage Details page, verify that access control is enabled.
    • If Access Control is Not Used, click the Edit button, then in the Access Control popup, change it to Enabled.
    • You can control access to IP access allowed, service resource allowed, Cloud Functions service, and Simple AI Training service only when access control is enabled.
  5. Click the Edit button of the Simple AI Training Service. 5. Simple AI Training Service Edit A popup window opens.
  6. After checking Allow, click the Confirm button.
Reference
  • Once the access permission settings for the Simple AI Training service are completed, you can retrieve the Training Script stored in Object Storage from the Simple AI Training service.
  • For how to load a Training Script stored in Object Storage from the Simple AI Training service, please refer to Training Job 생성하기.
How-to guides
File and Folder Management