Home directories and keeping each user isolated

A common setup is one service over one bucket, with several clients uploading into it, and each client able to see only their own files. That is what the home directory on a user is for.

Setting a home directory

When you add a user to a service, the Storage section has a Home directory field - the path inside the bucket that user is confined to. You can change it later from the user's edit menu.

• / puts the user at the root of the bucket, where they can see everything
• /acme confines them to the acme folder

So for three clients sharing one bucket, give them /acme, /globex and /initech. Each one logs in and sees their own folder as their root. They cannot see the folder names of the others, and they cannot see the bucket root.

The folder does not have to exist first - it appears when the user uploads.

Can a user climb out of their home directory?

No. The home directory is a hard boundary, not a starting point.

Every path a user asks for is anchored at its own root and cleaned before it is joined to their home prefix, which discards any .. segments. A client that sends ../ or ../../other-client cannot walk up the tree - the traversal is collapsed away and the request resolves back inside their own folder. The same applies to listing, stat and every other operation, not just downloads.

This holds even if the home directory itself is set to something odd: a home of .. is anchored at the root too, so it cannot resolve above the bucket root.

Restricting what DocEvent itself can reach

The home directory isolates users from each other. If you also want to limit what DocEvent can touch in a bucket you use for other things, scope the credentials you give it - see Restrictive S3 bucket permissions.

The two work together: the IAM policy bounds the service, and home directories bound each user within it.

One service or several?

Either works.

• One service, one home directory per user - simplest, one hostname, one set of credentials to manage, and one bucket.
• A service per client - when each client has their own bucket or their own cloud account, or when you want their usage and logs kept separate.

Users are named serviceid/username, so users on different services are already distinct even if the local part is the same. See Forward slash in the username if your FTP client struggles with that format.