Purpose
Describes the safety facts an agent — or a person — should know before calling the
gateway’s operator MCP tools. This page mirrors the security-posture
MCP resource served over the same connection: any authenticated MCP client can read
it directly (security:///posture), regardless of that caller’s IAM
scope. This page exists so the same facts are reachable without an open MCP
connection. If the two ever disagree, the MCP resource is the source of record.
Content summary
Five facts: presigned URLs are signed with the server’s own credentials and outlive
the caller’s; scoped credentials enforce bucket scope only — the ReadOnly /
WriteOnly / ReadWrite policy value is recorded but not enforced; writes to an
existing key overwrite silently; deletes are permanent; and resource listings omit
anything the caller isn’t authorized to see rather than showing it redacted (except
for a small set of always-listed box-level entries, described below).
Presigned URLs (get_presigned_url)
URLs are signed with the server’s own credentials, not the caller’s. Maximum
validity is 7 days (604800 seconds). Anyone who holds the URL can download the
object — no additional credentials are required. A presigned URL remains valid
even after the caller’s own credentials are revoked.
Scoped credentials (assume_role_scoped)
The gateway enforces the bucket scope on every request made with the minted STS
session. Requests targeting a different bucket are denied. The policy value
(ReadOnly, WriteOnly, ReadWrite) is recorded
in the response metadata but is not enforced — a session minted
with ReadOnly can still write and delete objects within the scoped
bucket.
Object writes (put_object)
If an object already exists at the same key, it is silently overwritten. There is
no confirmation prompt and no way to recover the previous content.
Object deletes (delete_object)
Deletion is permanent and irreversible. Once an object is deleted, it cannot be
recovered.
Resource discovery
The resources/list response filters bucket and object entries to what
the caller is authorized to access — unauthorized entries are absent, not redacted.
Box-level entries such as this security-posture resource are static, not
bucket-derived, and are listed for every authenticated caller regardless of IAM
scope.
