3 ms·

Been looking at using B2 to back up a few systems including a remote server. I've gone through the docs and didn't find anything on this so figured I'd ask here

by g_p 9y ago

Been looking at using B2 to back up a few systems including a remote server. I've gone through the docs and didn't find anything on this so figured I'd ask here since this post popped up with perfect timing! Can you have multiple API "keys" set up for different buckets within one account? And can these keys be permissioned to constrain an API key to bucket(s), and to control the operations possible within that bucket? My use-case here would be for the remote server to have a B2 API key available to it which only permits data to be added to the bucket. That way, if the server were ever compromised, an attacker couldn't tamper with or erase the backups. I'd use another (more privileged) API key to do any maintenance of deleting from buckets as-and-when it was needed. The reason for asking about having separate keys for buckets was purely for "isolation", so a laptop backup bucket API key wouldn't be able to do anything to the desktop bucket (and vice versa etc.)

ac29 9y ago
>Can you have multiple API "keys" set up for different buckets within one account? And can these keys be permissioned to constrain an API key to bucket(s), and to control the operations possible within that bucket? B2 user here. No, and its the one thing keeping me from migrating more data from S3 to B2. One key at a time only, and there is no permission granularity. Since the backblaze folks seem to read these threads, please make this happen! I'm ready to give you more money per month.
- g_p 9y ago
  Thanks for your reply. That's a real shame - I am sure I could segregate the different devices by making multiple accounts under the "groups" system, but that gets a bit messy! I'd love to see this happen! Even if it was just a list of the API functions from the docs with a checkbox against each, hidden behind a "danger" screen, it would make me feel more confident using this! Even if it wasn't granular per-bucket, it would make it a little safer when leaving credentials in cronjobs or bash scripts.
  - brianwski 9y ago
    Brian from Backblaze here. > two separate credentials It is literally at the very top of our list to do. I'm staring at my task list and helping out on that is my number one task. You should see it coming soon!
  - atYevP 9y ago
    I'm staring at Brian starting at it...
atYevP 9y ago
Hey there! Short answer is: No. Long answer is: It's a high-runner on our task list, no ETAs, but we're aware there's a need!

by g_p 9y ago

ac29 9y ago

>Can you have multiple API "keys" set up for different buckets within one account? And can these keys be permissioned to constrain an API key to bucket(s), and to control the operations possible within that bucket? B2 user here. No, and its the one thing keeping me from migrating more data from S3 to B2. One key at a time only, and there is no permission granularity. Since the backblaze folks seem to read these threads, please make this happen! I'm ready to give you more money per month.

g_p 9y ago
Thanks for your reply. That's a real shame - I am sure I could segregate the different devices by making multiple accounts under the "groups" system, but that gets a bit messy! I'd love to see this happen! Even if it was just a list of the API functions from the docs with a checkbox against each, hidden behind a "danger" screen, it would make me feel more confident using this! Even if it wasn't granular per-bucket, it would make it a little safer when leaving credentials in cronjobs or bash scripts.
- brianwski 9y ago
  Brian from Backblaze here. > two separate credentials It is literally at the very top of our list to do. I'm staring at my task list and helping out on that is my number one task. You should see it coming soon!
- atYevP 9y ago
  I'm staring at Brian starting at it...

atYevP 9y ago

Hey there! Short answer is: No. Long answer is: It's a high-runner on our task list, no ETAs, but we're aware there's a need!