I thought I'd try out the new bucket policy support in Luminous. My goal
was simply to permit access on a bucket to another user.
I have 2 users, "gta" and "gta2", both of which are in the default ("")
tenant. "gta" also owns the bucket named "gta". I want to grant access
on this bucket to user gta2.
My policy file:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {"AWS": "arn:aws:iam:::gta2"},
"Action": "s3:*",
"Resource": ["arn:aws:s3:::gta/*"]
}
]
}
Uploads ok to ceph...
% s3cmd setpolicy s3policy s3://gta
and I can read this back with awscli:
% aws s3api get-bucket-policy --bucket=gta
{
"Policy": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n
{\n \"Effect\": \"Allow\",\n \"Principal\": {\"AWS\":
\"arn:aws:iam:::gta2\"},\n \"Action\": \"s3:*\",\n
\"Resource\": [\"arn:aws:s3:::gta/*\"]\n }\n ]\n}\n"
}
However gta2 still cannot access the bucket...
% ./s3cmd-fceph-gta2 ls s3://gta
ERROR: Access to bucket 'gta' was denied
ERROR: S3 error: 403 (AccessDenied)
I see that when uploading the policy file, radosgw logs this:
Supplied principal is discarded: arn:aws:iam:::gta2
Looking at the source for rgw_iam_policy.cc it looks like this is
because I'm not prefixing the user name with "user/" as hinted on the
doc page http://docs.ceph.com/docs/master/radosgw/bucketpolicy/. I can
just set a wildcard, {"AWS": "*"} which radosgw seems to accept without
discarding, however user gta2 still has no access.
So tried setting the principal to {"AWS": "arn:aws:iam:::user/gta2"}
This just resulted in a crash dump from radosgw... in summary
rgw_iam_policy.cc: In function 'boost::optional<rgw::auth::Principal>
rgw::IAM::parse_principal(CephContext*, rgw::IAM::TokenID,
std::string&&)' thread 7fe8332a0700 time 2017-07-12 13:46:27.468022
rgw_iam_policy.cc: 716: FAILED assert(match.size() == 2)
Is this because I'm specifying the policy incorrectly... or does it not
work if there's no tenant?
Thanks for any ideas,
Graham
--
Graham Allan
Minnesota Supercomputing Institute - gta@xxxxxxx
_______________________________________________
ceph-users mailing list
ceph-users@xxxxxxxxxxxxxx
http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
