Scope Object Storage by Tenant
Trace tenant ownership from database rows to blob keys and access policies.
A database row may say who owns a file, but object storage often serves the bytes. If a download route accepts an object key directly or a worker writes into a shared bucket, the database policy may not apply. AWS tenant isolation strategies describe both pooled and siloed storage choices; either needs a clear access rule.
Map the object path
For each file type, record how a key is created, who can upload it, where the owner is stored, which identity reads it, and how it is deleted. Include thumbnails and processed derivatives, not only the original upload.
| Operation | Owner fact | Required check |
|---|---|---|
| Upload | Authenticated tenant and intended record | Bind new object to approved tenant |
| Read | Stored object ownership | Authorize current caller before issuing bytes or URL |
| Copy | Source and destination owners | Prevent silent cross-tenant movement |
| Delete | Object and derivative ownership | Remove only intended tenant's objects |
| Backup or restore | Original tenant metadata | Preserve boundary after recovery |
Avoid relying only on a tenant prefix in the object name. A broad service credential can still address every prefix, and a caller-supplied path can choose the wrong one. The server should derive the storage key from a trusted record or verified tenant context. If direct bucket access is part of the design, document the storage policy and its tests.
Create two synthetic files with different marker text. Test allowed read and delete, cross-tenant denial, missing database row, stale derivative, and revoked membership. Confirm denied operations leave the object unchanged. For a signed URL, check issue and expiry separately; a copied URL can remain usable after a UI session ends.
Check derived files
Illustrative mapping: file record F7 belongs to A, original object O7 belongs to F7, and thumbnail T7 stores sourceFileId=F7 plus sourceVersion=3. The preview route resolves T7 through F7 and checks current A read permission before issuing bytes or a URL. As B, request T7 directly through every serving path; require no bytes. Replace F7 with version 4 and require T7 to remain unpublished until it matches the accepted source version.
OWASP's multi-tenant cheat sheet supports this end-to-end view. The artifact is an object-access path map. It shows where ownership can be lost between metadata, storage, and delivery. Keep the validation inside an owned or explicitly authorized environment.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.