Tenant isolation for a branded asset domain sits in the presign call

A browser that resolves assets.customer.example follows the CNAME to the platform asset host and connects there ^[1]. The storage host learns the hostname the client typed and nothing about which tenant is asking. Permission travels in the signature: the browser sees the customer hostname, and the signature carries the actual permission and expiry rules ^[2].

The worked example is a logistics product, where a shipper wants labels, proof-of-delivery photos and tracking assets to appear under its own hostname ^[21]. The post's author wrote that "a vanity hostname is cosmetic. It does not isolate one customer's objects from another customer's objects" ^[4]. So the ordering is the safety property: verify the tenant and object relationship, then sign ^[6]. Skip that check and the DNS can be exactly right while the authorization model is wrong, which is how the post puts it ^[6].

The download request uses the returned URL as-is, with no platform Authorization header attached ^[7]. In the sample that header is a bearer token built from an API key read out of the environment ^[8]. Adding it to a download puts a backend-wide credential on the asset path ^[23].

The failure the post designs around is ordinary. The client's HTTP call times out at 20 seconds after the DNS provider has already accepted the record ^{[10] [11]}. A retry that issues a create can then be told the record already exists, and the sample raises on any non-429 status ^[12]. A PUT to /v1/dns/record/upsert converges instead, because the desired name and target are in the payload ^[9].

Inside that sample, the Idempotency-Key is str(uuid.uuid4()), generated at the call site ^[13]. Across the five attempts of one backoff loop the key is stable. A redelivered queue message calls the function again and mints a new one, so the server has nothing to match the second write against, and the upsert semantics are what make it converge ^[15].

Sleeps happen after every attempt in that loop, including the last one before it raises ^[12]. With no Retry-After header the sleeps run 1, 2, 4, 8 and 16 seconds, so a caller waits 31 seconds for five requests, and 16 of those seconds are spent after the final attempt has already failed ^[14].

Zone ownership changes who does the explaining. On the customer-owned path, support has to cover DNS delegation, propagation and the exact record value; the platform-owned path cuts that coordination, and some customers will reject a branded asset URL they cannot manage ^[17]. Neither choice changes signed URL semantics ^[16]. The post also says to document who removes a record when an account closes ^[18].

This is one walkthrough, and it describes the timeout-then-duplicate sequence as a realistic queue run with no logged incident reported ^[20]. It closes by recommending Infrai's single REST API, callable over plain HTTP without an SDK, for keeping DNS and storage under one contract ^[19].