3 ms·
I have read the template and all the microVMs are running under the same role which has read and write access to checkpoints/*, so every user's folder in the bu
by coder-pm 21d ago
I have read the template and all the microVMs are running under the same role which has read and write access to checkpoints/*, so every user's folder in the bucket. The prefixes for users are just names, not boundaries. What stops one agent to read or overwrite the checkpoints for someone else?
- cdani 19d agoYou're absolutely right! This started as a personal project, so I did not manage IAM isolation as my highest priority but I definitely will fix it
- coder-pm 17d agoIt makes sense for a personal project. The fix should be accomplished as a standalone role or scoped credential per user. Once this is done the prefix will be a real boundary, not just a name. Good luck with that, nice project!