Hello,
We have a problem with a R/W policy on a bucket.
If the bucket owner grant read/write access to another user, the objects
created by the grantee are not accessible by the owner (see below) !?!
Why does the owner of a bucket not access objects created by a grantee?
Is is a bug?
## Setup
- radosgw 12.2.5, with OpenStack Keystone integration
- PROJECT_A owner of bucket A
- PROJECT_B with R/W access to bucket A
With the OpenStack Keystone integration the radosgw user ID is the OpenStack
project ID. Users are only member of a project.
## S3 Policy
The S3 bucket policy `projectB_read-write.json` grant R/W access to PROJECT_B:
{
"Version": "2012-10-17",
"Id": "read-write",
"Statement": [
{
"Sid": "projectB-read_write",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::PROJECT_B_ID:root"
]
},
"Action": [
"s3:ListBucket",
"s3:PutObject",
"s3:DeleteObject",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
}
## Example of the problem
Owner (PROJECT_A) creates bucket and set policy:
$ s3cmd -c s3cfg-projectA mb s3://test
$ s3cmd -c s3cfg-projectA setpolicy projectB_read-write.json s3://test
Grantee (PROJECT_B) uploads an object into the bucket:
$ s3cmd -c s3cfg-projectB put example.data s3://test
upload: 'example.data' -> 's3://test/example.data' [part 1 of 2, 15MB] [1
of 1]
15728640 of 15728640 100% in 1s 14.99 MB/s done
upload: 'example.data' -> 's3://test/example.data' [part 2 of 2, 479kB]
[1 of 1]
491466 of 491466 100% in 0s 2.99 MB/s done
Owner (PROJECT_B) tries to download the object uploaded by grantee (PROJECT_B):
$ s3cmd -c s3cfg-projectA get s3://test/example.data
download: 's3://test/example.data' -> './example.data' [1 of 1]
ERROR: S3 error: 403 (AccessDenied)
## Possible workaround
If we add the bucket owner (PROJECT_A) in the policy too, then he will be able
to access objects created by the grantee (PROJECT_B):
"Principal": {
"AWS": [
"arn:aws:iam::PROJECT_A_ID:root",
"arn:aws:iam::PROJECT_B_ID:root"
]
},
--
SWITCH
Valéry Tschopp, Software Engineer
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
Email: [email protected] Phone: +41 44 268 1544
https://www.switch.ch/
_______________________________________________
ceph-users mailing list
[email protected]
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
