Question

How to secure a bucket without Access Keys

Posted on March 8, 2025
DigitalOcean Spaces
Asked by RomanIvn

Hi,

Im holding a bucket with thousands of of small files (3dTiles for map streaming viewer).

I want to keep my raw data secure so that its accesible only through my app.

I dont want to proxy the files through my own software or implement a temporary signed url for each individual file. That creates a wastfull overhead and looses the whole benefit of CDN , cache, loadbalancing etc.

Right now I’ve set a CDN with CloudFlare and applied a firewall over there so that only my app can access the cdn url.

But if somehow the url from digitalocean leaks all my files are readble.

Is there a way to set up a kind of firewall to allow only calls from the subdomain set by the cdn?

That way I can leverage the firewall in the subdomain

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Jeffrey Wolfe • March 9, 2025

You’re on the right track by using Cloudflare’s firewall, but to fully secure your DigitalOcean Spaces bucket without using access keys, you need to restrict access at the bucket level.

First, set your bucket permissions to private in DigitalOcean Spaces so files cannot be accessed publicly by default. Then, use Cloudflare’s origin rules to allow only requests coming from your app’s domain or a specific referrer, preventing direct access to the bucket URL. While you mentioned not wanting to generate temporary signed URLs for every file, you can optimize this by batching URL signatures or using Cloudflare Workers to generate them dynamically when needed.

DigitalOcean Spaces does not support request filtering based on domain headers, but you can mitigate exposure by disabling direct public access and only serving files via Cloudflare.