# Breaking the Static Key Habit: Modernizing Ceph RGW S3 Security with STS

DevFeed: [Breaking the Static Key Habit: Modernizing Ceph RGW S3 Security with STS](<https://devfeed.tech/articles/breaking-the-static-key-habit-modernizing-ceph-rgw-s3-security-with-sts-12327.md>)

Original publisher: [Read original article](<https://ceph.io/en/news/blog/2025/rgw-modernizing-sts/>)

Author: Daniel Alexander Parkes, Anthony D'Atri

Published: 2025-12-18T00:00:00Z

Content type: tutorial

Language: en

Sources: [Ceph Blog](<https://devfeed.tech/sources/ceph-blog.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>), [Credential theft](<https://devfeed.tech/topics/credential-theft.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [App](<https://devfeed.tech/topics/app.md>)

Tags: [amazon-s3](<https://devfeed.tech/tags/amazon-s3.md>), [app](<https://devfeed.tech/tags/app.md>), [aws](<https://devfeed.tech/tags/aws.md>), [blog-post](<https://devfeed.tech/tags/blog-post.md>), [ceph](<https://devfeed.tech/tags/ceph.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [code](<https://devfeed.tech/tags/code.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [en-article](<https://devfeed.tech/tags/en-article.md>), [en-blog-post](<https://devfeed.tech/tags/en-blog-post.md>), [github](<https://devfeed.tech/tags/github.md>), [rgw](<https://devfeed.tech/tags/rgw.md>), [s3](<https://devfeed.tech/tags/s3.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This tutorial explains how to replace long-lived S3 credentials in Ceph Object Gateway (RGW) applications with temporary credentials issued through Security Token Service (STS). It uses the Uber breach to illustrate how stolen static keys can enable persistent unauthorized access, and discusses credentials stored in configuration files, scripts, and CI/CD variables.

## Source excerpt

Introduction: The USD 148 Million Lesson ¶ In late 2016, Uber learned that intruders had accessed a trove of personal data stored in an Amazon S3 bucket. The entry point was painfully mundane: attackers accessed Uber's source code on GitHub using stolen credentials, found an AWS credential, and used it to access Uber's data. That single, long-lived credential exposed data on roughly 57 million users and 600,000 drivers. The breach was bad; the duration risk was worse. Static access keys do not expire. Once leaked, they remain active until someone notices, locates every instance in use, and rotates them. That makes credential theft uniquely dangerous in cloud and S3-style storage, because an attacker can repeatedly return, automate access, and quietly expand their footprint. Uber ultimately agreed to a $148 million multistate settlement related to how the incident was handled and disclosed. The exact dollar figure is not the main lesson, though. The lesson is this: a single static key can turn a small mistake into a durable breach. If you are running the Ceph Object Gateway (RGW), you face the same dynamic: S3 credentials in an application configuration file config.yaml, embedded in scripts, or stored in CI/CD variables. Each one is a long-lived credential that, once copied, can be used from anywhere the S3 endpoint is reachable. This post shows you how to eliminate static credentials using Security Token Service (STS) with temporary credentials that expire automatically. By the end, you'll understand how to implement the same security model that prevented these breaches from being even worse, and how to adapt it for Ceph RGW. The Static Credential Problem ¶ Let's take a look at some examples of how most applications access S3 storage today: # app-config.yaml (application config file) s3: endpoint: https://s3.example.com access_key: AKIA1234567890ABCDEF secret_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY bucket: production-data Or with the credentials embedded direc