# Mastering IAM in Ceph: Multi-Tenancy, Access Control, and Why ACLs Must Die

DevFeed: [Mastering IAM in Ceph: Multi-Tenancy, Access Control, and Why ACLs Must Die](<https://devfeed.tech/articles/mastering-iam-in-ceph-multi-tenancy-access-control-and-why-acls-must-die-12334.md>)

Original publisher: [Read original article](<https://ceph.io/en/news/blog/2026/mastering-iam/>)

Author: Daniel Alexander Parkes, Anthony D'Atri

Published: 2026-01-24T00:00:00Z

Content type: article

Language: en

Sources: [Ceph Blog](<https://devfeed.tech/sources/ceph-blog.md>)

Topics: [IAM](<https://devfeed.tech/topics/iam.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Security](<https://devfeed.tech/topics/security.md>), [Multi-tenancy](<https://devfeed.tech/topics/multi-tenancy.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>)

Tags: [access-control](<https://devfeed.tech/tags/access-control.md>), [aws](<https://devfeed.tech/tags/aws.md>), [blog-post](<https://devfeed.tech/tags/blog-post.md>), [ceph](<https://devfeed.tech/tags/ceph.md>), [defense-in-depth](<https://devfeed.tech/tags/defense-in-depth.md>), [en-article](<https://devfeed.tech/tags/en-article.md>), [en-blog-post](<https://devfeed.tech/tags/en-blog-post.md>), [iam](<https://devfeed.tech/tags/iam.md>), [identity](<https://devfeed.tech/tags/identity.md>), [multi-tenancy](<https://devfeed.tech/tags/multi-tenancy.md>), [operations](<https://devfeed.tech/tags/operations.md>), [production](<https://devfeed.tech/tags/production.md>), [rgw](<https://devfeed.tech/tags/rgw.md>), [s3](<https://devfeed.tech/tags/s3.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This article explains why ACLs in Ceph Object Gateway should be disabled in favor of centralized IAM policies. It discusses S3 permission failures, multi-tenant access problems, AWS's ACL-disabled defaults, and defense-in-depth measures such as Block Public Access and explicit denies for ACL operations.

## Source excerpt

Introduction ¶ Introduction: When Security Theater Becomes a Real Disaster ¶ In March 2017, a misconfigured S3 bucket at Verizon exposed the personal information of 14 million customers. The root cause wasn't a sophisticated attack; it was a simple oversight in access permissions. The bucket was set to be publicly accessible due to S3 permission misconfiguration, and no one noticed because ACLs were managed separately from the company's centralized IAM policies. The security team had implemented careful, identity-based access controls, but a resource-level ACL silently bypassed them by granting access to "All Users." This scenario repeats constantly across the industry: ACLs creating invisible access paths that security teams don't know exist, buckets accidentally exposed to the public internet, and contractors uploading data that the bucket owner cannot reliably read or administer, while still consuming capacity. Between 2017 and 2019, major companies exposed hundreds of millions of records via misconfigured S3 permissions (ACLs and/or bucket policies): Verizon (2017): 14 million customers - An AWS S3 bucket configured for public access exposed names, addresses, account PINs Facebook (2019): 540 million records - Third-party apps stored user data in publicly accessible S3 buckets Instagram (2019): 49 million records - Marketing firm left influencer database unprotected in AWS S3 The AWS response was clear: since April 2023, all new S3 buckets default to "ACLs disabled" (BucketOwnerEnforced) and Block Public Access enabled. AWS strongly recommends disabling ACLs on existing buckets and migrating to a pure policy-based model with IAM Accounts architecture. If you're running the Ceph Object Gateway (RGW), you have access to the same IAM Accounts model introduced in Ceph Squid 19.2.0. This post explains why ACLs must be disabled immediately and how to implement modern, secure access control with IAM policies. Do This First (Quick Security Wins) Before reading further,