625991469a
Policy and AppRole applied. Store Valid, ExternalSecret SecretSynced. Prefix empty. WAL not enabled.
47 lines
2 KiB
Markdown
47 lines
2 KiB
Markdown
# CCR-2026-0012 — scoped backup key verification
|
|
|
|
Date: 2026-08-14
|
|
Status: **applied — Secret `databases/platform-pg-backup-s3` synced**
|
|
CCR: approved in chat 2026-08-14
|
|
Path: `platform/workloads/railiance/backup/object-storage` (KV v2 version 1)
|
|
|
|
No secret values in this file.
|
|
|
|
## What is in OpenBao
|
|
|
|
| Field | Present |
|
|
| --- | --- |
|
|
| `ACCESS_KEY` | yes (len 20, `SCW…`) |
|
|
| `SECRET_KEY` | yes |
|
|
| `DEFAULT_ORGANIZATION_ID` | yes |
|
|
| `DEFAULT_PROJECT_ID` | yes |
|
|
| `APPLICATION_ID` | yes as of version 2 (UUID, not printed here) |
|
|
|
|
Distinct from the CCR-2026-0011 bootstrap key (`keys_differ=yes`).
|
|
|
|
## Positive
|
|
|
|
- `scw object bucket list` / `get railiance-platform-pg-backup` in `nl-ams` succeeded.
|
|
- boto3 put/get/delete of a probe object under `platform-pg/` succeeded; probe deleted.
|
|
- Sibling prefix write is now denied (`AccessDenied`) after the
|
|
`resource-control-scoped-backup` bucket policy
|
|
(`BackupListPrefix`, `BackupObjectsUnderPrefix`) applied 2026-08-14.
|
|
|
|
## Negative
|
|
|
|
- Bogus secret against the same access key: `SignatureDoesNotMatch`.
|
|
- `scw iam application list` / `user list` / `api-key get`: insufficient permissions.
|
|
- `scw billing budget list`: not allowed.
|
|
- `scw k8s cluster list`: insufficient permissions.
|
|
|
|
`instance` / `vpc` / `rdb` / `registry` / `lb` list returned empty success. That is consistent with a project that has no those resources; it is not a proven compute-write deny. Do not create a paid resource to prove it.
|
|
|
|
## Cluster delivery (same day)
|
|
|
|
- Policy `workload-kv-read-backup-object-storage` written.
|
|
- AppRole `external-secrets-backup-object-storage` (15m/30m, 8 uses).
|
|
- Secret `external-secrets/openbao-backup-object-storage-approle` applied; local delivery shredded.
|
|
- ClusterSecretStore `openbao-backup-object-storage` Ready/Valid, condition `databases` only.
|
|
- ExternalSecret `databases/platform-pg-backup-s3` SecretSynced. Keys `ACCESS_KEY_ID` (len 20) and `ACCESS_SECRET_KEY` (len 36). Values not read.
|
|
- Prefix `platform-pg/` object count: 0.
|
|
- `platform-pg` still has no `barmanObjectStore`. WAL is T05.
|