page:guides:flask:private file access
Enforce private-file authorization for Flask
Summary
Private file access for a Flask app on Ample. Verified on Flask: a role-to-document access model with negative tests (401, 403) and an authorized private-bucket round-trip (private=ok). Build and start: pip install into .ample/python from requirements.txt, then waitress from app.py reading PORT on the python-3.12 template.
Prerequisites
- A Flask project (pip install into .ample/python from requirements.txt, then waitress from app.py reading PORT on the python-3.12 template)
- A PostgreSQL driver reading DATABASE_URL at runtime
- A bucket from
ample bucket createwith credentials passed as encrypted S3_* environment variables - An Ample account token with servers:write, databases:read, buckets:read
Workflow Steps
- Build and start: pip install into .ample/python from requirements.txt, then waitress from app.py reading PORT on the python-3.12 template; the server must bind 0.0.0.0 on PORT.
- Create the bucket and pass its credentials: Create it once with
ample bucket create, then pass endpoint, region, bucket and keys with --env; use path-style addressing.
Command:ample deploy . --name --public --start "python3 app.py" --env S3_ENDPOINT=... --env S3_REGION=... --env S3_BUCKET=... --env S3_ACCESS_KEY_ID=... --env S3_SECRET_ACCESS_KEY=... - Authorize before touching storage: Return 401 for unauthenticated requests and 403 for the wrong role; keep the bucket unpublished and stream objects through the app.
- Verify: Fetch the live URL and /p/private-document-library on the example; on failure read the build and runtime logs.
Command:ample logs --kind build
Examples
- Flask pattern fixture: Verified private file access on Flask.
Success Checks
- App responds on its public URL when accessing
/. - The
/p/private-document-libraryendpoint check from the example should return the expected results.
Limitations
- Verified on the python-3.12 template at s-1vcpu-1gb; other sizes and Flask major versions are not verified.
- Region, compliance attestations and request-duration limits are unknown and not claimed.
- Managed PostgreSQL 16 only; extensions, connection limits and backup or restore procedures are not verified.
Cost Estimate
- Currency: USD
- Monthly Amount: 10.0
- Components:
- App server: s-1vcpu-1gb ($5.0/month)
- Managed PostgreSQL database: s-1vcpu-1gb ($5.0/month)
- Note: Always-on monthly price of the tested sizes; apps auto-pause when idle. Buckets are allocation-priced per quota and not included.
Evidence Summary
- Canary run: Flask pattern fixture deployed on Ample; contains a role-to-document access model with negative tests (401, 403) and an authorized private-bucket round-trip (private=ok).
Observed at: 2026-09-21T01:14:18Z.