Bucket policies in Luminous

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



I thought I'd try out the new bucket policy support in Luminous. My goal was simply to permit access on a bucket to another user.

I have 2 users, "gta" and "gta2", both of which are in the default ("") tenant. "gta" also owns the bucket named "gta". I want to grant access on this bucket to user gta2.

My policy file:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam:::gta2"},
      "Action": "s3:*",
      "Resource": ["arn:aws:s3:::gta/*"]
    }
  ]
}

Uploads ok to ceph...
% s3cmd setpolicy s3policy s3://gta

and I can read this back with awscli:
% aws s3api get-bucket-policy --bucket=gta
{
"Policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\"AWS\": \"arn:aws:iam:::gta2\"},\n \"Action\": \"s3:*\",\n \"Resource\": [\"arn:aws:s3:::gta/*\"]\n }\n ]\n}\n"
}

However gta2 still cannot access the bucket...
% ./s3cmd-fceph-gta2 ls s3://gta
ERROR: Access to bucket 'gta' was denied
ERROR: S3 error: 403 (AccessDenied)

I see that when uploading the policy file, radosgw logs this:
Supplied principal is discarded: arn:aws:iam:::gta2

Looking at the source for rgw_iam_policy.cc it looks like this is because I'm not prefixing the user name with "user/" as hinted on the doc page http://docs.ceph.com/docs/master/radosgw/bucketpolicy/. I can just set a wildcard, {"AWS": "*"} which radosgw seems to accept without discarding, however user gta2 still has no access.

So tried setting the principal to {"AWS": "arn:aws:iam:::user/gta2"}

This just resulted in a crash dump from radosgw... in summary

rgw_iam_policy.cc: In function 'boost::optional<rgw::auth::Principal> rgw::IAM::parse_principal(CephContext*, rgw::IAM::TokenID, std::string&&)' thread 7fe8332a0700 time 2017-07-12 13:46:27.468022
rgw_iam_policy.cc: 716: FAILED assert(match.size() == 2)

Is this because I'm specifying the policy incorrectly... or does it not work if there's no tenant?

Thanks for any ideas,

Graham
--
Graham Allan
Minnesota Supercomputing Institute - gta@xxxxxxx
_______________________________________________
ceph-users mailing list
ceph-users@xxxxxxxxxxxxxx
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com



[Index of Archives]     [Information on CEPH]     [Linux Filesystem Development]     [Ceph Development]     [Ceph Large]     [Ceph Dev]     [Linux USB Development]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [xfs]


  Powered by Linux