How do I give developers, ops, and external partners access to the same file storage?

A common pattern is to put one shared file-storage layer in the middle and control access with groups, roles, and partner-specific boundaries.

Recommended approach

1) Use a centralized shared storage platform

Pick a file storage system that supports:

• Fine-grained permissions
• Role-based access control (RBAC)
• Audit logs
• External collaboration / guest access
• Encryption at rest and in transit
• API or sync access for developers and ops

Examples:

• Cloud: AWS S3 + IAM, Azure Blob + Entra ID, Google Cloud Storage + IAM
• Shared file services: SharePoint/OneDrive, Box, Dropbox Business, Google Drive
• Internal enterprise file systems: NFS/SMB with identity integration, though external access is usually harder

---

2) Separate access by identity type

Create distinct access groups for:

• Developers
• Operations
• External partners

Then map each group to:

• specific folders/buckets/projects
• read/write permissions
• upload-only or read-only access where needed

Example:

• dev-team → read/write to /engineering/
• ops-team → read/write to /ops/, read-only to /engineering/releases/
• partner-acme → read-only to /shared/partner-acme/ and upload-only to /inbound/partner-acme/

---

3) Use folder or bucket segmentation

Don’t give everyone access to one giant folder if you can avoid it. Instead:

• One root storage system
• Subfolders/buckets by audience or function
• Restrict by default, then grant access explicitly

A good pattern is:

• /internal/dev/
• /internal/ops/
• /external/partners/acme/
• /external/partners/beta/

If partners should not see each other’s files, give each partner their own isolated space.

---

4) Use SSO and guest accounts for external partners

For employees:

• Use your company identity provider, like Okta, Azure AD, Google Workspace

For external partners:

• Prefer guest/guest federation access over shared passwords
• Require:
  • MFA
  • expiration dates
  • scoped permissions
  • periodic review

If the platform supports it, use federated identity so partners log in with their own organization’s credentials.

---

5) Add controls for operations and compliance

Especially if this storage is business-critical:

• Versioning
• Backup/retention
• Immutable storage / object lock if needed
• Audit trails
• Approval workflow for partner onboarding/offboarding

---

Security best practices

• Follow least privilege
• Avoid using shared accounts
• Use separate folders/buckets for partner data
• Encrypt sensitive files
• Review access regularly
• Expire access when projects end
• Log downloads, uploads, deletions, and sharing events

---

Simple implementation examples

Option A: Cloud object storage

Best if access is mostly app-driven or file exchange:

• Devs upload via APIs
• Ops manages infrastructure/backups
• Partners access limited prefixes or presigned links

Option B: Managed collaboration tool

Best if humans edit files together:

• Use SharePoint/Box/Google Drive
• Create team sites and external sharing policies
• Great for documents, spreadsheets, SOPs, and partner collaboration

Option C: Hybrid

• Internal systems store source files in cloud storage
• Partners get access through a collaboration portal or secure file exchange layer

---

Rule of thumb

If everyone needs to edit the same living documents, use a collaboration platform.
If systems and applications need storage, use object storage with IAM.
If partners are involved, avoid flat shared folders and use segmented, auditable, expiring access.

If you want, I can give you:

1. a recommended architecture,
2. a permissions matrix, or
3. a setup example for AWS/Azure/Google/SharePoint.