Manage the S3 protocol

The WEKA configuration of the S3 protocol.

The S3 protocol is integral to numerous cloud-native applications, and within the WEKA system, it offers a range of technical capabilities:

  • Data management:

    • Ingest data using the S3 protocol.

    • Access ingested data using S3 or other supported protocols.

  • Data exposure to S3:

    • Enable seamless migration of applications within the WEKA data platform by making existing data accessible through the S3 protocol. This integration ensures a smooth transition without the need for data relocation.

  • Cloud integration:

    • Enable cloud bursting to use new applications without relocating data.

  • Multi-protocol access with WEKA:

    • Leverage WEKA's scale, performance, and resiliency advantages.

    • Gradually transition applications to S3, maintaining data access through multiple protocols: POSIX, S3, SMB, NFS, and GPUDirect Storage.

The WEKA S3 service is designed for scalability and resilience. Implementation involves specifying WEKA servers running the S3 protocol and creating a logical S3 cluster to expose the service. Scalability is achieved through multiple servers, and load balancing or round-robin DNS integration facilitates access by numerous clients.

The WEKA S3 service builds on the WEKA filesystem service, mapping buckets to top-level directories and objects to files, allowing data exposure through various WEKA-supported protocols.

Guidelines for managing S3 access and security

S3 access

Users can access S3 APIs with either authenticated or anonymous methods.

  • Authenticated S3 access: To gain authenticated S3 access, follow these guidelines:

    • Create a local WEKA user with an assigned S3 user role.

    • Attach an IAM policy to the S3 user, specifying S3 operations and resource permissions.

    • S3 users can generate temporary security tokens (STS AssumeRole) or employ service accounts with restricted permissions.

  • Anonymous access: You can use the following options:

    • .

    • .

S3 security

  • Encryption of data at rest:

    • Data written through the S3 protocol can be encrypted at rest by configuring an encrypted filesystem.

  • Transport Layer Security (TLS):

    • Clients access the service securely through HTTPS, using the same certificates as WEKA's other API access points.

S3 audit

  • Auditing S3 API calls:

    • S3 API calls are auditable using an HTTP webhook service, integrating into applications such as .

  • Setting audit targets:

    • Set an audit target using the weka s3 cluster audit-webhook enable CLI command.

Workflow: Managing S3 resources in WEKA

This workflow guides you through the process of setting up and managing S3 resources within the WEKA system. It covers essential procedures, from creating an S3 cluster and bucket to uploading and downloading objects from S3 buckets. Each step demonstrates the seamless integration of WEKA's capabilities in handling data through the S3 protocol.

Select each tab in the specified order to explore the demonstrations.

Create an S3 cluster within the WEKA environment, specifying the servers to run the S3 protocol and establishing a logical cluster for exposing the S3 service.

A predefined configuration filesystem (.config_fs in this demo) must exist to maintain the persisting cluster-wide protocol configurations.

Alternative CLI command

weka s3 cluster create default .config_fs --all-servers

Related topics

Create an S3 cluster (using the GUI)

Create an S3 cluster (using the CLI)

As a quick workflow guide, here is a summary of the CLI commands for configuring your S3 cluster and implementing the desired settings:

weka s3 cluster create default .config_fs --all-servers
weka s3 bucket create mybucket
weka user add S3_user S3
weka s3 policy attach readwrite
weka security tls download

Last updated