3 ms·
IAM gets only a tiny mention as not present, therefore making R2 simpler. But also... IAM is missing and a lot of interesting use cases are not possible there.
by viraptor 2y ago
IAM gets only a tiny mention as not present, therefore making R2 simpler. But also... IAM is missing and a lot of interesting use cases are not possible there. No access by path, no 2fa enforcing, no easy SSO management, no blast radius limits - just would you like a token which can write a file, but also delete everything? This is also annoying for their zone management for the same reason.
- eddd-ddde 2y agoUsually you'd delegate that to a CF worker. Your logic can be fully implemented by you. No single user gets a direct access token, but rather uses your preferred auth mechanism.
- viraptor 2y agoSure, you could. But that means every team effectively writing their own custom authz instead of a common description language. And then paying extra per call for it.