--- title: Ceph.io — Breaking the Static Key Habit: Modernizing... description: A hands-on guide shows how to replace long-lived, static S3 access keys in Ceph RGW with Security Token Service (STS) temporary credentials, using the Uber... canonical: https://daily.dev/posts/ceph-io-breaking-the-static-key-habit-modernizing-ceph-rgw-s3-security-with-sts-qqtvmhhk3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ceph.io — Breaking the Static Key Habit: Modernizing Ceph RGW S3 Security with STS | daily.dev og:description: A hands-on guide shows how to replace long-lived, static S3 access keys in Ceph RGW with Security Token Service (STS) temporary credentials, using the Uber... og:url: https://daily.dev/posts/ceph-io-breaking-the-static-key-habit-modernizing-ceph-rgw-s3-security-with-sts-qqtvmhhk3 og:image: https://api.daily.dev/og/posts/QqTvmhhk3.png og:image:alt: Ceph.io — Breaking the Static Key Habit: Modernizing Ceph RGW S3 Security with STS og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ceph.io — Breaking the Static Key Habit: Modernizing Ceph RGW S3 Security with STS **[Ceph](https://daily.dev/sources/ceph)** · 23 min read · 0 upvotes · 0 comments ## Summary A hands-on guide shows how to replace long-lived, static S3 access keys in Ceph RGW with Security Token Service (STS) temporary credentials, using the Uber 2016 breach and $148M settlement as motivation. It walks through enabling STS in RGW config, creating IAM accounts, service users, roles with trust/permission policies, assuming roles via AWS CLI and Python (boto3), handling credential expiration for long-running jobs (manual refresh, RefreshableCredentials, aws-assume-role-lib), and rotating static service-account keys using the new create_date field introduced in Ceph Tentacle. A follow-up post is promised covering deeper IAM architecture and OIDC-based identity federation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I enable STS authentication in Ceph RGW? Set two config options on the RGW client: a 16-character rgw_sts_key used to sign session tokens, and rgw_s3_auth_use_sts set to true, then restart the RGW instances. For example, run ceph config set client.rgw.default rgw_sts_key <16-char-key> and ceph config set client.rgw.default rgw_s3_auth_use_sts true. The key must be exactly 16 characters or the STS handshake fails silently or with opaque 500 errors. _Teams rolling out STS on Ceph RGW can track related infra changes and gotchas on daily.dev._ ### What is the maximum STS session duration supported in Ceph RGW? Ceph RGW supports STS temporary credentials with a default duration of 3600 seconds (1 hour), a minimum of 900 seconds (15 minutes) via rgw_sts_min_session_duration, and a maximum of 12 hours (43,200 seconds) configurable via rgw_sts_max_session_duration or a role's max_session_duration attribute. For jobs longer than 12 hours, automatic credential refresh with boto3's RefreshableCredentials is recommended instead of extending token duration. _Anyone designing long-running jobs against S3-compatible storage can follow credential handling updates on daily.dev._ ### What Ceph version added the create_date field for access keys to support key rotation? Starting with Ceph Tentacle, RGW includes a create_date timestamp on each access key returned by radosgw-admin user info, enabling programmatic tracking of key age and automated rotation workflows. This lets operators pair a secrets manager (Vault, AWS Secrets Manager, etc.) with scheduled key rotation, keeping old and new keys active during a transition period before retiring the old key. _Developers automating credential rotation can keep up with Ceph release changes like this on daily.dev._ ## Similar posts on daily.dev - [Fourth challenge on DevOpsLedger](https://daily.dev/posts/fourth-challenge-on-devopsledger-l6xk0k65f) · Medium · 0 upvotes · 0 comments - [Ceph.io — \[CVE\] \[URGENT\] Squid v19.2.6 and Tentacle v20.2.4 released](https://daily.dev/posts/ceph-io-cve-urgent-squid-v19-2-6-and-tentacle-v20-2-4-released-bzynabdep) · Ceph · 5 upvotes · 0 comments - [Why Organizations Are Abandoning Static Secrets for Managed Identities](https://daily.dev/posts/why-organizations-are-abandoning-static-secrets-for-managed-identities-l5n3swmh4) · The Hacker News · 0 upvotes · 0 comments - [External Authentication: Exploring WS-Trust for Authentication](https://daily.dev/posts/external-authentication-exploring-ws-trust-for-authentication-spzotjodf) · Security Boulevard · 0 upvotes · 0 comments - [How to automate Ceph RGW user management on OpenShift with GitOps](https://daily.dev/posts/how-to-automate-ceph-rgw-user-management-on-openshift-with-gitops-tbj5qemtw) · Red Hat Developer · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#aws-s3](https://daily.dev/tags/aws-s3), [#iam](https://daily.dev/tags/iam) [View this post on daily.dev](https://daily.dev/posts/ceph-io-breaking-the-static-key-habit-modernizing-ceph-rgw-s3-security-with-sts-qqtvmhhk3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ceph.io — Breaking the Static Key Habit: Modernizing Ceph RGW S3 Security with STS","url":"https://daily.dev/posts/ceph-io-breaking-the-static-key-habit-modernizing-ceph-rgw-s3-security-with-sts-qqtvmhhk3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ceph-io-breaking-the-static-key-habit-modernizing-ceph-rgw-s3-security-with-sts-qqtvmhhk3"},"datePublished":"2026-08-23T12:18:16.160Z","dateModified":"2026-08-23T12:22:49.744Z","description":"A hands-on guide shows how to replace long-lived, static S3 access keys in Ceph RGW with Security Token Service (STS) temporary credentials, using the Uber...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ae29f8844b0cde622632100a921b7174?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ae29f8844b0cde622632100a921b7174?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Ceph","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ceph","logo":"https://media.daily.dev/image/upload/s--nHzZM4Ap--/f_auto,q_auto/v1787487446/logos/ceph?_a=BAMAMicg0","url":"https://daily.dev/sources/ceph"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ceph-io-breaking-the-static-key-habit-modernizing-ceph-rgw-s3-security-with-sts-qqtvmhhk3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,aws-s3,iam","timeRequired":"PT23M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ceph","item":"https://daily.dev/sources/ceph"},{"@type":"ListItem","position":3,"name":"Ceph.io — Breaking the Static Key Habit: Modernizing Ceph RGW S3 Security with STS"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ceph-io-breaking-the-static-key-habit-modernizing-ceph-rgw-s3-security-with-sts-qqtvmhhk3#faq","mainEntity":[{"@type":"Question","name":"How do I enable STS authentication in Ceph RGW?","acceptedAnswer":{"@type":"Answer","text":"Set two config options on the RGW client: a 16-character rgw_sts_key used to sign session tokens, and rgw_s3_auth_use_sts set to true, then restart the RGW instances. For example, run ceph config set client.rgw.default rgw_sts_key <16-char-key> and ceph config set client.rgw.default rgw_s3_auth_use_sts true. The key must be exactly 16 characters or the STS handshake fails silently or with opaque 500 errors. Teams rolling out STS on Ceph RGW can track related infra changes and gotchas on daily.dev."}},{"@type":"Question","name":"What is the maximum STS session duration supported in Ceph RGW?","acceptedAnswer":{"@type":"Answer","text":"Ceph RGW supports STS temporary credentials with a default duration of 3600 seconds (1 hour), a minimum of 900 seconds (15 minutes) via rgw_sts_min_session_duration, and a maximum of 12 hours (43,200 seconds) configurable via rgw_sts_max_session_duration or a role's max_session_duration attribute. For jobs longer than 12 hours, automatic credential refresh with boto3's RefreshableCredentials is recommended instead of extending token duration. Anyone designing long-running jobs against S3-compatible storage can follow credential handling updates on daily.dev."}},{"@type":"Question","name":"What Ceph version added the create_date field for access keys to support key rotation?","acceptedAnswer":{"@type":"Answer","text":"Starting with Ceph Tentacle, RGW includes a create_date timestamp on each access key returned by radosgw-admin user info, enabling programmatic tracking of key age and automated rotation workflows. This lets operators pair a secrets manager (Vault, AWS Secrets Manager, etc.) with scheduled key rotation, keeping old and new keys active during a transition period before retiring the old key. Developers automating credential rotation can keep up with Ceph release changes like this on daily.dev."}}]} ```