spreadshirt
[FEAT] - Add 'Delete' Object to the viewer with permission based access control (per bucket)
A nice feature would be the ability to 'delete' objects from the viewer for specific buckets you may have elevated privileges for.
Hi. This is something we also thought about while implementing the plugin. However, this requires some extra permission layer (not Backstage, but the Bucket permissions itself), which would need some communication to ensure that the user in Backstage actually matches the one in S3.
Since it was a really complex topic, we didn't really implement a feature and kept is as a read-only + download object option.
How would you suggest doing this?
So we have a tenancy with a svc account for backstage that controls all of the S3 facilities.
E.g. it creates user buckets on demand, etc.. We then use permission framework and modifications to your Provider file to ensure that X user can only view buckets with there user ids etc...
All interactions with S3 is a single svc account, but its just a matter of what we show them in the viewer etc that's controlled..
We do this because we have workflows in backstage (scaffolder) to allow them to upload files to S3 with custom extensions etc...
It's not a critical feature for now, as we'll be running automation jobs to clean up the buckets contents each week, but it'd be nice to have.
Alright, I think I get it. So we could extend the current setup to, based on the listed buckets, to allow users to click on delete for an object. I would imagine a new permission rule for the deletion too though.
I think this should be doable, indeed. Even though people implementing should ensure that this is safe and are not allowing people to delete critical stuff when not allowed. Would you like to take it? I guess using your setup will make it easier for testing already.
This one requires a bit more thought than the rest, so can continue with them for a release.
I'll need to ensure security and as you mentioned a permission to 'allow delete'.
I'd say that by default no one has access, unless admin or you are the owner of the bucket - problem for me is I don't use AWS so testing the AWS component part of it will be a bit sketch... I'll have a play this weekend and see what I can come up with. But as I said this isn't an urgent thing, I have manual ad-hoc scaffolders to clear them for now.