diff --git a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx index 696449eae4..de89f39514 100644 --- a/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx +++ b/pages/object-storage/how-to/use-obj-stor-with-private-networks.mdx @@ -27,9 +27,11 @@ Object Storage private access is the recommended method to securely reach a buck -1. Enable Object Storage private access on the VPC, and select the Private Networks within this VPC you want to authorize, using the [VPC API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/). +1. [Enable Object Storage private access on the VPC](/vpc/how-to/enable-object-storage-private-access/#enable-object-storage-private-access-on-a-vpc). -2. Configure your Object Storage client on the resources of the authorized Private Networks to use the private regional endpoint `s3-vpc..scw.eu`. +2. [Select the Private Networks you want to authorize](vpc/how-to/enable-object-storage-private-access/#edit-the-private-networks-with-access) within this VPC. + +3. [Configure your Object Storage client](/vpc/how-to/enable-object-storage-private-access/#reach-a-bucket-over-the-private-endpoint) on the resources of the authorized Private Networks to use the private regional endpoint `s3-vpc..scw.eu`. See [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) for more information. diff --git a/pages/vpc/how-to/enable-object-storage-private-access.mdx b/pages/vpc/how-to/enable-object-storage-private-access.mdx index 8f8f008ce1..4d2db42fba 100644 --- a/pages/vpc/how-to/enable-object-storage-private-access.mdx +++ b/pages/vpc/how-to/enable-object-storage-private-access.mdx @@ -15,17 +15,40 @@ import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-acces - A Scaleway account logged into the [console](https://console.scaleway.com) - [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization -- A valid [API key](/iam/how-to/create-api-keys/) +- A valid [API key](/iam/how-to/create-api-keys/), if you use the API - A [VPC](/vpc/how-to/create-vpc/) with at least one [Private Network](/vpc/how-to/create-private-network/) - An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) in the region of the VPC ## Enable Object Storage private access on a VPC -Enabling Object Storage private access on a VPC triggers billing for the feature. +Enabling Object Storage private access on a VPC triggers billing for the feature. Billing is hourly, and any started hour is due. -1. Enable Object Storage private access on the VPC, listing the Private Networks to authorize: + + + 1. In the [Scaleway console](https://console.scaleway.com/organization) side menu, go to **Network** > **VPC**. A listing of your VPCs appears. + + 2. Use the **region selector** at the top of the page to filter for the region of your VPC, then click the VPC in the listing. + + 3. Click the **Connectivity** tab, then click **Enable private access** in the **Object Storage private access** section. The **Object Storage private access** page opens. + + 4. Check that the **Object Storage region** matches the region of your VPC. + + 5. Select the Private Networks to authorize in the **Private Networks with access** list. You can search for a Private Network by name, and use the **Show only selected** toggle to review your selection. + + + The private endpoint is created for the whole VPC, but access is controlled per Private Network. Only the resources attached to the selected Private Networks can reach Object Storage privately. + + + 6. Review the estimated cost in the **Summary** panel, then click **Enable**. A confirmation dialog box displays the private endpoint of the region, for example `s3-vpc.fr-par.scw.eu`. + + 7. Click the copy icon to copy the private endpoint, then click **OK**. + + The **Connectivity** tab displays the status of the feature, the private endpoint, and the Private Networks with access. + + + Run the following command to enable Object Storage private access on the VPC, listing the Private Networks to authorize: ```bash curl -X POST \ @@ -35,7 +58,28 @@ Enabling Object Storage private access on a VPC triggers billing for the feature "https://api.scaleway.com/vpc/v2/regions/{region}/object-storage-private-access/{vpc_id}/enable" ``` -2. Add another Private Network, if needed: + See the [VPC API documentation](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/) for more information. + + + + +Enabling Object Storage private access does not automatically route traffic to the private endpoint. You must configure your Object Storage client to do so. + + +## Edit the Private Networks with access + + + + 1. In the [Scaleway console](https://console.scaleway.com/organization) side menu, go to **Network** > **VPC**, then click the VPC of your choice. + + 2. Click the **Connectivity** tab, then click **Edit access** in the **Object Storage private access** section. A dialog box appears. + + 3. Select or deselect the Private Networks to authorize. + + 4. Click **Save**. + + + Run the following command to authorize another Private Network: ```bash curl -X POST \ @@ -45,11 +89,9 @@ Enabling Object Storage private access on a VPC triggers billing for the feature "https://api.scaleway.com/vpc/v2/regions/{region}/object-storage-private-access/{vpc_id}/private-networks" ``` - -Enabling Object Storage private access does not automatically route traffic to the private endpoint. You must configure your Object Storage client to do so. - - -Refer to the [VPC API documentation](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/) for more information. + See the [VPC API documentation](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/) for more information. + + ## Reach a bucket over the private endpoint @@ -57,7 +99,7 @@ Resources in an authorized Private Network reach Object Storage privately only w 1. Connect to an Instance attached to an authorized Private Network of the VPC. -2. Configure your Object Storage client to point at the private endpoint of the region. For the AWS CLI, set the `endpoint_url` in your `~/.aws/config` file: +2. Configure your Object Storage client to point at the private endpoint of the region, displayed in the **Connectivity** tab of your VPC. For the AWS CLI, set the `endpoint_url` in your `~/.aws/config` file: ``` [default]