[
https://issues.apache.org/jira/browse/HADOOP-15525?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16506657#comment-16506657
]
Thomas Poepping commented on HADOOP-15525:
------------------------------------------
[~fabbri] FWIW AWS IAM can do this with IAM policies.
https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/
Which is to say that a certain IAM policy attached to (probably) an IAM role
can only read/list/delete something under a specific keyspace in S3.
The solution for this in AWS EMR is to provide a mapping in configuration that
EmrFS (EMR's internal Hadoop-compatible S3 filesystem) uses to assume those
roles to get different credentials before making requests to S3.
https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-emrfs-iam-roles.html
On EMR, this is a little simpler because the service controls provisioning of
the cluster. It is likely to be a more ambiguous problem to solve in open
source, where any users can deploy it anywhere.
I was responsible for the AWS EMR solution to this problem, I would be happy to
involve myself as much as I'm allowed in preparation of this feature.
> s3a: clarify / improve support for mixed ACL buckets
> ----------------------------------------------------
>
> Key: HADOOP-15525
> URL: https://issues.apache.org/jira/browse/HADOOP-15525
> Project: Hadoop Common
> Issue Type: Bug
> Components: fs/s3
> Affects Versions: 3.0.0
> Reporter: Aaron Fabbri
> Assignee: Aaron Fabbri
> Priority: Major
>
> Scenario: customer wants to only give a Hadoop cluster access to a subtree of
> an S3 bucket.
> For example, assume Hadoop uses some IAM identity "hadoop", which they wish
> to grant full permission to everything under the following path:
> s3a://bucket/a/b/c/hadoop-dir
> they don't want hadoop user to be able to read/list/delete anything outside
> of the hadoop-dir "subdir"
> Problems:
> To implement the "directory structure on flat key space" emulation logic we
> use to present a Hadoop FS on top of a blob store, we need to create / delete
> / list ancestors of {{hadoop-dir}}. (to maintain the invariants (1) zero-byte
> object with key ending in '/' exists iff empty directory is there and (2)
> files cannot live beneath files, only directories.)
> I'd like us to either (1) document a workaround (example IAM ACLs) that gets
> this basic functionality, and/or (2) make improvements to make this less
> painful.
> We've discussed some of these issues before but I didn't see a dedicated JIRA.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
