1. A method implemented in a non-transitory machine-readable storage medium and processed by one or more processors configured to perform the method, comprising: authenticating a principal, via principal-supplied credentials within a cloud storage environment; identifying the principal for a first access within the cloud storage environment; generating a public key and a private key for the principal within the cloud storage environment; storing the public key and private key in a secret store within the cloud storage environment; receiving a write request from the principal for a file to be stored within the cloud storage environment while the principal is still authenticated and only when the principal is authenticated for an access session with the cloud storage environment; granting access to the public key and private key to the principal within the shared-storage environment and through the authenticated access session; subsequently for each write request made by the principal within the cloud storage environment, the principal is re-authenticated; receiving a signature for contents of the file from a file system, signed with the private key, within the shared-storage environment; and storing the file and a control data structure for the file within the cloud storage environment, the control data structure including the public key and the signature.