Public vs. Private Buckets & CDN Edge Caching

Nyota Drive implements a dual-bucket storage topology designed to strictly isolate sensitive internal company documents from publicly distributed web assets (like e-commerce product photos, marketing videos, and app downloads).

This guide explains the security differences between Public and Private buckets, how global edge CDN caching works, how to generate pre-signed access URLs, and how to bind custom CNAME domain aliases.

1. How It Works Under the Hood

When you create a bucket in Nyota Drive, you define its visibility boundary:

YOUR STORAGE ASSETS
                                         │
         ┌───────────────────────────────┴───────────────────────────────┐
         ▼                                                               ▼
┌────────────────────────────────┐              ┌────────────────────────────────┐
│         PRIVATE BUCKET         │              │          PUBLIC BUCKET         │
│  (visibility: "private")       │              │  (visibility: "public")        │
│                                │              │                                │
│  - DIRECT WEB ACCESS BLOCKED   │              │  - CLOUDFLARE CDN CACHED       │
│  - Requires S3 API Key, Bearer │              │  - Sub-30ms global latency     │
│    JWT, or Pre-signed S3 URL   │              │  - Unauthenticated GET access  │
│  - Use Case: Contracts,        │              │  - Use Case: Product images,   │
│    database backups, invoices  │              │    app assets, public media    │
└────────────────────────────────┘              └────────────────────────────────┘

2. Comparison: Private vs. Public Buckets

3. Accessing Private Objects Securely (Pre-Signed S3 URLs)

To grant temporary download access to a private file without exposing your master API keys or making the bucket public, generate a short-lived Pre-Signed S3 URL:

Read Nyota Drive docs at https://docs.nyotaimara.com/docs/2-nyota-drive

4. Serving Assets via Custom Domain CNAME (Public Buckets)

You can serve public bucket assets through your own branded subdomain (e.g., https://media.yourcompany.com/hero.png instead of the default assets.drive.nyotaimara.com):

Step 1: Add CNAME in Your DNS Provider

1. Log in to your DNS provider (e.g., Cloudflare, Namecheap, GoDaddy).
2. Create a new CNAME record:
3. • Type: CNAME
   • Name / Host: media (or cdn)
   • Target / Value: cname.drive.nyotaimara.com
   • TTL: Auto / 300 seconds

Step 2: Bind Domain in Nyota Drive

1. Log in to drive.nyotaimara.com.
2. Click on your Public Bucket 
   →→
    Settings 
   →→
    Custom Domains.
3. Enter your subdomain (media.yourcompany.com) and click "Bind Custom Domain".
4. Nyota Drive automatically provisions an SSL/TLS certificate within 5 minutes.

5. Common Pitfalls & How to Troubleshoot

Pitfall A: "Why does my public asset URL return 403 Forbidden?"

• The Cause: The file was uploaded into a bucket configured as visibility: "private".
• The Resolution:
• 1. Open drive.nyotaimara.com.
  2. Click the file options and select "Move to Public Bucket".
  3. The system will execute a physical copy to your public bucket and generate a live CDN link.

Pitfall B: "I accidentally uploaded a confidential document to a public bucket."

• The Cause: Sensitive files (e.g., payroll records, client identity scans) were stored in a public bucket.
• The Resolution (Immediate Action Required):
• 1. Go to drive.nyotaimara.com.
  2. Delete the file from the public bucket immediately.
  3. In the bucket settings, click "Purge CDN Cache" to instantly invalidate cached copies across all global edge servers.
  4. Re-upload the file into a Private Bucket.

Related Support Guides & Links

• Getting Started with Zero-Egress S3 Storage
• Creating Password-Protected Share Links
• Direct Nyota Drive Web Console