Decision of the TC on 2021-08-18:
- The S3 API is the protocol for external (non-Postgres) object storage in FOLIO and standard environment variables/configuration of an S3 server on a per module basis.
- The module implementation of object storage must conform to the FOLIO standards for tenant separation
- The recommended standards will be referenced/pointed out by the tech leads.
- e.g. how tenant separation should be handled, etc.
- Jakub Skoczen will raise the topic with the tech leads
- The recommended standards will be referenced/pointed out by the tech leads.
- Should the min.io client library be the recommended client as object storage choice agnostic library, but modules could also choose the native S3 implementation?
- Yes.
- Should teams be allowed to store binary data in Postgres? In some cases (amount of data is small, etc.)?
- Yes. If external object storage (not Postgres) is required, it must be S3.
- Regardless of which is used, tenant separation still must be done. (x3)
Request of the Security Group on 2021-08-20:
- Binary files must be stored with strict tenant and module separation.
- A FOLIO MinIO security guide for developers and sysops must be published and reviewed by the security team before more modules start using it.
- e.g. Including guidance for how to do the tenant/module separation.
- The tech leads group will discuss this as noted during the TC meeting (see TC 2021-08-18 Meeting notes).