Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,11 @@ Object Storage private access is the recommended method to securely reach a buck

<ObjectStoragePrivateAccess />

1. Enable Object Storage private access on the VPC, and select the Private Networks within this VPC you want to authorize, using the [VPC API](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/).
1. [Enable Object Storage private access on the VPC](/vpc/how-to/enable-object-storage-private-access/#enable-object-storage-private-access-on-a-vpc).

2. Configure your Object Storage client on the resources of the authorized Private Networks to use the private regional endpoint `s3-vpc.<YOUR_REGION>.scw.eu`.
2. [Select the Private Networks you want to authorize](vpc/how-to/enable-object-storage-private-access/#edit-the-private-networks-with-access) within this VPC.

3. [Configure your Object Storage client](/vpc/how-to/enable-object-storage-private-access/#reach-a-bucket-over-the-private-endpoint) on the resources of the authorized Private Networks to use the private regional endpoint `s3-vpc.<YOUR_REGION>.scw.eu`.

See [Configuring Object Storage private access](/vpc/how-to/enable-object-storage-private-access/) for more information.

Expand Down
62 changes: 52 additions & 10 deletions pages/vpc/how-to/enable-object-storage-private-access.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,40 @@ import ObjectStoragePrivateAccess from '@macros/vpc/object-storage-private-acces

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- A valid [API key](/iam/how-to/create-api-keys/)
- A valid [API key](/iam/how-to/create-api-keys/), if you use the API
- A [VPC](/vpc/how-to/create-vpc/) with at least one [Private Network](/vpc/how-to/create-private-network/)
- An [Object Storage bucket](/object-storage/how-to/create-a-bucket/) in the region of the VPC

## Enable Object Storage private access on a VPC

<Message type="note">
Enabling Object Storage private access on a VPC triggers billing for the feature.
Enabling Object Storage private access on a VPC triggers billing for the feature. Billing is hourly, and any started hour is due.
</Message>

1. Enable Object Storage private access on the VPC, listing the Private Networks to authorize:
<Tabs>
<TabsTab label="Console">
1. In the [Scaleway console](https://console.scaleway.com/organization) side menu, go to **Network** > **VPC**. A listing of your VPCs appears.

2. Use the **region selector** at the top of the page to filter for the region of your VPC, then click the VPC in the listing.

3. Click the **Connectivity** tab, then click **Enable private access** in the **Object Storage private access** section. The **Object Storage private access** page opens.

4. Check that the **Object Storage region** matches the region of your VPC.

5. Select the Private Networks to authorize in the **Private Networks with access** list. You can search for a Private Network by name, and use the **Show only selected** toggle to review your selection.

<Message type="tip">
The private endpoint is created for the whole VPC, but access is controlled per Private Network. Only the resources attached to the selected Private Networks can reach Object Storage privately.
</Message>

6. Review the estimated cost in the **Summary** panel, then click **Enable**. A confirmation dialog box displays the private endpoint of the region, for example `s3-vpc.fr-par.scw.eu`.

7. Click the copy icon to copy the private endpoint, then click **OK**.

The **Connectivity** tab displays the status of the feature, the private endpoint, and the Private Networks with access.
</TabsTab>
<TabsTab label="API">
Run the following command to enable Object Storage private access on the VPC, listing the Private Networks to authorize:

```bash
curl -X POST \
Expand All @@ -35,7 +58,28 @@ Enabling Object Storage private access on a VPC triggers billing for the feature
"https://api.scaleway.com/vpc/v2/regions/{region}/object-storage-private-access/{vpc_id}/enable"
```

2. Add another Private Network, if needed:
See the [VPC API documentation](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/) for more information.
</TabsTab>
</Tabs>

<Message type="important">
Enabling Object Storage private access does not automatically route traffic to the private endpoint. You must configure your Object Storage client to do so.
</Message>

## Edit the Private Networks with access

<Tabs>
<TabsTab label="Console">
1. In the [Scaleway console](https://console.scaleway.com/organization) side menu, go to **Network** > **VPC**, then click the VPC of your choice.

2. Click the **Connectivity** tab, then click **Edit access** in the **Object Storage private access** section. A dialog box appears.

3. Select or deselect the Private Networks to authorize.

4. Click **Save**.
</TabsTab>
<TabsTab label="API">
Run the following command to authorize another Private Network:

```bash
curl -X POST \
Expand All @@ -45,19 +89,17 @@ Enabling Object Storage private access on a VPC triggers billing for the feature
"https://api.scaleway.com/vpc/v2/regions/{region}/object-storage-private-access/{vpc_id}/private-networks"
```

<Message type="important">
Enabling Object Storage private access does not automatically route traffic to the private endpoint. You must configure your Object Storage client to do so.
</Message>

Refer to the [VPC API documentation](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/) for more information.
See the [VPC API documentation](https://www.scaleway.com/en/developers/api/vpc/object-storage-private-access/) for more information.
</TabsTab>
</Tabs>

## Reach a bucket over the private endpoint

Resources in an authorized Private Network reach Object Storage privately only when they target the private endpoint. A client configured with the public endpoint keeps sending its requests over the public internet.

1. Connect to an Instance attached to an authorized Private Network of the VPC.

2. Configure your Object Storage client to point at the private endpoint of the region. For the AWS CLI, set the `endpoint_url` in your `~/.aws/config` file:
2. Configure your Object Storage client to point at the private endpoint of the region, displayed in the **Connectivity** tab of your VPC. For the AWS CLI, set the `endpoint_url` in your `~/.aws/config` file:

```
[default]
Expand Down
Loading