railiance-platform/docs/evidence/CCR-2026-0012-backup-key-verify-2026-08-14.md

CCR-2026-0012 — scoped backup key verification

Date: 2026-08-14
Status: applied — Secret databases/platform-pg-backup-s3 synced
CCR: approved in chat 2026-08-14
Path: platform/workloads/railiance/backup/object-storage (KV v2 version 1)

No secret values in this file.

What is in OpenBao

Field	Present
ACCESS_KEY	yes (len 20, SCW…)
SECRET_KEY	yes
DEFAULT_ORGANIZATION_ID	yes
DEFAULT_PROJECT_ID	yes
APPLICATION_ID	yes as of version 2 (UUID, not printed here)

Distinct from the CCR-2026-0011 bootstrap key (keys_differ=yes).

Positive

• scw object bucket list / get railiance-platform-pg-backup in nl-ams succeeded.
• boto3 put/get/delete of a probe object under platform-pg/ succeeded; probe deleted.
• Sibling prefix write is now denied (AccessDenied) after the resource-control-scoped-backup bucket policy (BackupListPrefix, BackupObjectsUnderPrefix) applied 2026-08-14.

Negative

• Bogus secret against the same access key: SignatureDoesNotMatch.
• scw iam application list / user list / api-key get: insufficient permissions.
• scw billing budget list: not allowed.
• scw k8s cluster list: insufficient permissions.

instance / vpc / rdb / registry / lb list returned empty success. That is consistent with a project that has no those resources; it is not a proven compute-write deny. Do not create a paid resource to prove it.

Cluster delivery (same day)

• Policy workload-kv-read-backup-object-storage written.
• AppRole external-secrets-backup-object-storage (15m/30m, 8 uses).
• Secret external-secrets/openbao-backup-object-storage-approle applied; local delivery shredded.
• ClusterSecretStore openbao-backup-object-storage Ready/Valid, condition databases only.
• ExternalSecret databases/platform-pg-backup-s3 SecretSynced. Keys ACCESS_KEY_ID (len 20) and ACCESS_SECRET_KEY (len 36). Values not read.
• Prefix platform-pg/ object count: 0.
• platform-pg still has no barmanObjectStore. WAL is T05.