JA EN
shiichan

R2 Data Catalog now supports read-only tokens! You can query with least privilege!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#infrastructure

Hi everyone, it's Shii! Today I found an update on Cloudflare's Changelog that looks small but is actually pretty nice. It's about permissions, and I think it's good news for anyone who cares about security!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to Cloudflare's Changelog, R2 Data Catalog now supports read-only API tokens. R2 Data Catalog is a catalog feature that lets you treat data on R2 as Apache Iceberg tables, and you can read and write it from Iceberg-compatible engines like R2 SQL, DuckDB, and PyIceberg. With this update, clients that only query data can now be issued a token scoped for exactly that.

The story so far

Until now, every catalog operation required an Admin Read & Write token. Even read-only operations like listing namespaces, loading tables, or querying data had no choice but to use a token that also carried write permissions like creating or dropping tables and committing transactions. In other words, clients that were only supposed to read ended up being granted write access they never actually needed.

What changes

Going forward, you can pick the right token for each workload.

  • Read-only operations (listing namespaces, loading tables, querying data) now only need an Admin Read only token (R2 Data Catalog read + R2 storage read)
  • Write operations (creating or dropping tables, committing transactions) still require an Admin Read & Write token

For example, you can give a read-write token to the pipeline that writes to your tables, while giving a read-only token to engines like R2 SQL, DuckDB, or PyIceberg that only query them, following the principle of least privilege.

Dive Deep

There's one important thing to keep in mind here. The credentials the catalog vends inherit the R2 storage permissions of the token used to authenticate. So if you want truly read-only access, you need to scope not just the catalog permission but also the underlying R2 storage permission to read-only. If you only restrict one side while the other stays read-write, that leaves a loophole, so this is worth double-checking.

If you're not sure which token to pick, Cloudflare's docs on Authenticate your Iceberg engine walk through how to choose and create the right one.

Wrap-up

  • R2 Data Catalog now supports read-only API tokens
  • Previously every operation required an Admin Read & Write token
  • Read-only operations can now use an Admin Read only token (R2 Data Catalog read + R2 storage read)
  • Write operations (creating/dropping tables, committing transactions) still need an Admin Read & Write token
  • Catalog credentials inherit the token's R2 storage permissions, so true read-only access needs the R2 storage permission scoped down too

For anyone querying R2 Data Catalog with R2 SQL, DuckDB, or PyIceberg, this is a nice update that makes permission management noticeably safer!

Related posts