The page has been translated by Gen AI.

Access control

When you configure a bucket with access control enabled, only resources that are granted permission can access the bucket. Enter a public IP, or configure settings to allow access to resources created in the Samsung Cloud Platform Console.

Setting Access Control

You can set the bucket’s access control to enabled.

Object Storage Follow these steps to configure access control settings.

  1. Click the All Services > Storage > Object Storage menu. 1. Navigate to the Service Home page.
  2. On the Service Home page, click the Object Storage menu. 2. Go to the Object Storage List page.
  3. Object Storage list page, click the resource (bucket) for which you want to configure access control. 3. Go to the Object Storage Details page.
  4. On the Object Storage Details page, verify that Access Control is Not Used.
  5. If Access control is unused, click the Edit button. 5. Edit Access Control The popup window opens.
  6. After checking the use of access control, click the Confirm button. 6. On the Object Storage Details page, Access Control will be changed to enabled.
    • If you change access control to Enabled, you can set access control for Public IP, service resources, Cloud Functions, Simple AI Training services.
  7. Click the Edit button of the resource or service you want to allow access to, to add resources or set whether to allow them.
    CategoryDetailed description
    Allow public IPRegistered Public IP or CIDR list
    • Example: 192.168.x.x, 192.168.x.x/24
    Allow service resourcesList of service resources created in the same Account/Region
    • Service examples: Virutal Server, GPU Server, Bare Metal Server, Multi-node GPU Cluster, VPC Endpoint, PostgreSQL, MariaDB, MySQL, EPAS, Microsoft SQL Server
    Cloud Functions serviceSet whether to allow Object Storage access for modifying Java Runtime code in the Cloud Functions service
    • Allow when set, the Cloud Fuctions service can load Java Runtime executable files stored in Object Storage
    Simple AI Training ServiceSet whether to allow Object Storage access for retrieving the Training Script in the Simple AI Training service
    • Allow when set, the Simple AI Training service can retrieve the Training Script stored in Object Storage
    Table. Access control items
Reference
  • When access control is set to unused, it is applied as full allow.
  • If you modify the access permission, it may take up to 30 seconds for the changes to be applied.
Reference
Access between Object Storage and Samsung Cloud Platform resources is supported only through the access control on the Object Storage detail screen.
When using IP access control in an IAM policy, note that access between Object Storage and SCP resources is not possible.
To use the service, you must set the IAM policy to Applied IP: All IPs, Excluded IP: Not used.
information

South Korea (kr-south) region constraints

  • The South Korea (kr-south) region does not provide Cloud Funtions service, so the Allow Cloud Functions service feature cannot be used.

Allow public IP access

If the bucket’s access control is set to enabled, you can add a Public IP allowance. To enable Public IP access from Object Storage, follow these steps.

  1. All Services > Storage > Object Storage Click the menu. 1. Navigate to the Service Home page.

  2. On the Service Home page, click the Object Storage menu. 2. Go to the Object Storage List page.

  3. On the Object Storage List page, click the resource (bucket) you want to set access control for. 3. Go to the Object Storage Details page.

  4. Object Storage Details On the page, verify that access control is enabled.

    • If Access Control is Unused, click the Edit button, then in the Access Control popup, change Access Control to Enabled.
    • Access control can control access to IP access allowed, service resource allowed, Cloud Functions service, Simple AI Training service only when enabled.

  5. Click the Edit button in Public IP Allow. 5. Public IP Allow Edit A popup window opens.

  6. Enter the Public IP to allow access, and click the Add button. 6. The entered IP appears in the IP to add list.

    columnRequiredDetailed description
    Allow public IPEssentialEnter a single IP or CIDR format
    • 192.168.x.x (IP format)
    • 192.168.x.x/24 (CIDR format)
    • Up to 150 entries can be entered
    Table. Public IP Allowance Edit Popup Input Items

  7. After checking the IP to add list, press the Confirm button.

  8. On the Object Storage Details page, check the added Public IP in the Access Control > Allow Public IP list.

Reference
  • If you modify the Public IP allowance, it may take up to 30 seconds for the changes to be applied.
  • Up to 150 public IPs are allowed.

Allow access to service resources

If access control on the bucket is set to enabled, you can add a service resource in the allowed service resources. Follow the steps below to allow access to service resources from Object Storage.

  1. All Services > Storage > Object Storage menu, click it. 1. Service Home Go to the page.
  2. On the Service Home page, click the Object Storage menu. 2. Go to the Object Storage List page.
  3. Object Storage List page, click the resource (bucket) for which you want to configure access control. 3. Go to the Object Storage Details page.
  4. Verify that Access Control is enabled on the Object Storage Details page.
    • If Access Control is Unused, click the Edit button, then in the Access Control popup, change Access Control to Enabled.
    • Access control can regulate access to IP access allowed, service resource allowed, Cloud Functions service, and Simple AI Training service only when it is enabled.
  5. Click the Edit button in Service Resource Allowance. 5. Select Service Resources The popup window opens.
  6. Select Service Resources In the popup window, select the service to grant access to, then select the resources to allow.
Information

  • The allowed criteria for each service are as follows.

    • Virtual Server/GPU Server/Bare Metal Server/Multi-node GPU Cluster: Allowed per server
    • VPC Endpoint: Allow per VPC Endpoint
    • PostgreSQL, MariaDB, MySQL, EPAS, Microsoft SQL Server: Allowed per cluster

  • To access Object Storage from the server, you must first perform the following steps.

    1. Check the Object Storage IP on the server using the nslookup command.
    2. After registering a rule through the Security Group or Firewall service, apply it to the server.
      • Target address: Object Storage IP confirmed in step 1
      • Direction: Outbound
      • Service: TCP 80, 443 (port 80 for http / port 443 for https)
Caution

When each service is in the following states, access to service resources can be granted or revoked. If it is not in the following state, the previously authorized service resources may also be affected.

  • Virtual Server/GPU Server: Build, Building, Networking, Scheduling, Block_Device_Mapping, Spawning, Deleting, Error and other states
  • Bare Metal Server/Multi-node GPU Cluster: Running, Starting, Stopping, Stopped
  • VPC Endpoint: Active
  • PostgreSQL/MariaDB/MySQL/EPAS/Microsoft SQL Server: Running
  1. After you finish selecting the resources to allow access, press the Confirm button.
  2. Check the resources you added in the Access Control > Service Resource Allow list on the Object Storage Details page.
Reference
  • If you modify service resource allowances, it may take up to 30 seconds for the changes to be applied.
  • A maximum of 150 service resources is allowed.

Allow access to Cloud Functions service

If access control on the bucket is set to enabled, you can allow the Cloud Functions service to access Object Storage.

To allow access to the Cloud Functions service from Object Storage, follow these steps.

  1. All Services > Storage > Object Storage Click the menu. 1. Navigate to the Service Home page.
  2. On the Service Home page, click the Object Storage menu. 2. Go to the Object Storage List page.
  3. Object Storage List page, click the resource (bucket) you want to configure access control for. 3. Go to the Object Storage Details page.
  4. Object Storage Details On the page, check that access control is enabled.
    • If Access Control is Unused, click the Edit button, then in the Access Control popup window, change Access Control to Enabled.
    • Access can be controlled for IP access allowed, service resource allowed, Cloud Functions service, and Simple AI Training service only when access control is enabled.
  5. Click the Edit button of the Cloud Functions service. 5. Cloud Functions Service Edit A popup window opens.
  6. After checking Allow, click the Confirm button.
Reference
  • Once the access permission settings for the Cloud Functions service are completed, the Cloud Functions service can retrieve the Java Runtime executable stored in Object Storage.
  • In the Cloud Fuctions service, refer to Java Runtime 코드 변경하기 for how to load the Java Runtime executable.
Reference

South Korea (kr-south) region constraints

  • The South Korea (kr-south) region does not provide the Cloud Functions service, so the Allow Cloud Functions service feature cannot be used.

Simple AI Training Allow Service Access

If access control for the bucket is set to enabled, you can allow the Simple AI Training service to access Object Storage.

If you want to permit access to the Simple AI Training service from Object Storage, follow the steps below.

  1. Click the All Services > Storage > Object Storage menu. 1. Go to the Service Home page.
  2. On the Service Home page, click the Object Storage menu. 2. Go to the Object Storage List page.
  3. Object Storage List page, click the resource (bucket) for which you want to configure access control. 3. Object Storage Details Navigate to the page.
  4. Object Storage Details Verify that access control is enabled on the page.
    • If Access Control is Unused, click the Edit button, then in the Access Control popup, change Access Control to Enabled.
    • When access control is enabled, you can control access to IP access allowed, service resource allowed, Cloud Functions service, and Simple AI Training service.
  5. Click the Edit button of Simple AI Training Service. 5. Simple AI Training Service Edit A popup window opens.
  6. After checking Allow, click the Confirm button.
Reference
  • Once the access permission settings for the Simple AI Training service are completed, you can retrieve the Training Script stored in Object Storage from the Simple AI Training service.
  • In the Simple AI Training service, see Training Job 생성하기 for how to load a Training Script stored in Object Storage.
How-to guides
File and Folder Management