S3 is canonical
PostgreSQL stores users, roles, storage config, cached object metadata, sync jobs, and audit events. Backup bytes are not ingested.
Security
Least privilege on the control plane. Objects stay in the bucket.
The application is an operations layer. It should never become a second copy of your dumps, and it should never send AWS keys to a browser.
Credentials
IAM instance/task roles are preferred. Access keys, when used, are encrypted at rest and never shown after save. Logs redact secrets and presigned query strings.
Downloads
Presigned URLs expire (default 15 minutes). The operator’s browser talks to S3, not to a file proxy stuffed with long-lived keys.
People and sessions
RBAC, optional TOTP, session listing, and lockout after repeated failures. Deletion requires permission plus confirmation and an audit row.
What we will not do
- Use the AWS root user or AdministratorAccess for day-to-day operations.
- Share one IAM identity across tenants that should not see each other’s prefixes.
- Treat this public site as a live console. Production estates stay behind authentication in the operations console.