Can inventory bucket be made public?

[CodyCBakerPhD]

The inventory bucket is currently private and requires some special IAM permissions to read from

The manifests are essentially just all the same content you can get by doing s5cmd ls on the entire bucket, which also shows all embargoed blobs/zarrs, so there is likely no reason that the manifests need to stay hidden

[jjnesbitt]

@satra @yarikoptic Any thoughts on this? I think we've adopted the philosophy of "file paths themselves aren't sensitive" w.r.t embargoed data. The data in the manifests only contains simple data like bucket name, key, object version ID, etc.

[jjnesbitt]

I do wonder if zarrs complicate this though. Zarr chunks are stored directly (not content addressed), and so it may be possible to derive more data from a zarr's file structure than you would from a normal blob's path. But maybe this is a non-issue.

[yarikoptic]

are we paying for this bucket (traffic) or it is also part of the open data program? if it is just a matter of IAM, what is really a difficulty/problem opening it would address as do you expect public tooling to make use of it?

[CodyCBakerPhD]

The bucket is on the open data account

[waxlamp]

The bucket is on the open data account

But it is a separate bucket from the one that is sponsored, so my understanding is we do pay the storage/transfer costs.

[CodyCBakerPhD]

But it is a separate bucket from the one that is sponsored, so my understanding is we do pay the storage/transfer costs.

The sponsorship is for the account

You do not pay for the log bucket (same account) - also separate from 'main DANDI bucket' - please confirm?

[satra]

You do not pay for the log bucket (same account) - also separate from 'main DANDI bucket' - please confirm?

confirm. i would say iam would be better for this.