Hi,
I am trying to restrict subuser to its bucket (so he/she can work only on a
bucket which has permission) with disabling ACLs and setting policy on a
bucket:
Using ceph version 19.2.2
bucket1-policy.json contains
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::tenant1:user/parent1:user1"
},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::bucket1",
"arn:aws:s3:::bucket1/*"
]
}
]
}
---
echo "lala" > test.txt
export RGW_ENDPOINT=""
radosgw-admin user create --tenant=tenant1 --uid=parent1 --key-type=s3
--display-name="tenant1:parent1"
for sub in user1 user2 user3; do
radosgw-admin subuser create --tenant=tenant1 --uid=parent1 --subuser=$sub
--key-type=s3 --access=full;
done
export AWS_ACCESS_KEY_ID=$(radosgw-admin user info --uid="parent1"
--tenant="tenant1" | jq .keys | jq -r '.[] |
select(.user=="tenant1$parent1:user1").access_key')
export AWS_SECRET_ACCESS_KEY=$(radosgw-admin user info --uid="parent1"
--tenant="tenant1" | jq .keys | jq -r '.[] |
select(.user=="tenant1$parent1:user1").secret_key')
aws s3api create-bucket --bucket bucket1 --object-ownership
BucketOwnerEnforced --endpoint-url $RGW_ENDPOINT
aws s3api put-bucket-policy --bucket bucket1 --policy
file://bucket1-policy.json --endpoint-url $RGW_ENDPOINT
aws s3api put-public-access-block --bucket bucket1
--public-access-block-configuration
BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
--endpoint-url $RGW_ENDPOINT
aws s3 cp test.txt s3://bucket1/test.txt --endpoint-url $RGW_ENDPOINT
aws s3 ls s3://bucket1 --endpoint-url $RGW_ENDPOINT
# verify
export AWS_ACCESS_KEY_ID=$(radosgw-admin user info --uid="parent1"
--tenant="tenant1" | jq .keys | jq -r '.[] |
select(.user=="tenant1$parent1:user2").access_key')
export AWS_SECRET_ACCESS_KEY=$(radosgw-admin user info --uid="parent1"
--tenant="tenant1" | jq .keys | jq -r '.[] |
select(.user=="tenant1$parent1:user2").secret_key')
aws s3 ls s3://bucket1 --endpoint-url $RGW_ENDPOINT
---
Script stops at aws s3 cp test.txt s3://bucket1/test.txt --endpoint-url
$RGW_ENDPOINT with an error like:
upload failed: ./test.txt to s3://bucket1/test.txt argument of type
'NoneType' is not iterable
If I comment the line with aws s3api put-public-access-block... I can
successfully upload some file, but I can also see the contents of bucket1
with user2, which is not what I want.
Any ideas how would I restrict the subuser to its bucket only?
I was actually able to restrict subuser to its bucket by explicitly denying
access to bucket with following policy:
https://lists.ceph.io/hyperkitty/list/[email protected]/message/AFNERFMNSC33BX2PO2D25GNTNIENGIPT/
But it doesn't feel the right way. Wouldn't be better to "restrict"
everything for everyone but its user in the first place and then allow
others to access?
Kind regards,
Rok
_______________________________________________
ceph-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
