Project

General

Profile

Bug #21582

s3:GetBucketLocation bucket policy fails with 403

Added by Adam Emerson 3 months ago. Updated 3 months ago.

Status:
Pending Backport
Priority:
Normal
Assignee:
Target version:
-
Start date:
09/27/2017
Due date:
% Done:

0%

Source:
Q/A
Tags:
Backport:
luminous
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
ceph-qa-suite:
Release:
Needs Doc:
No

Description

After setting the policy, get_location() on the bucket fails to work.

Version-Release number of selected component (if applicable):
ceph-radosgw-12.2.0-2.el7cp.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Create a bucket with tenant user testx$tester
2. Write a bucket policy providing s3:GetBucketLocation to another user in the same or different tenant
3. After setting the policy, try doing a get_location() on the bucket with the permitted user credentials.

Actual results:
S3ResponseError: 403 Forbidden

Additional info: {
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"AWS": ["arn:aws:iam::testy:user/u2"]},
"Action": ["s3:ListBucket", "s3:GetBucketLocation"],
"Resource": [
"arn:aws:s3::*:location-bucket",
"arn:aws:s3::*:location-bucket/*"
]
}]
}

b = conn.get_bucket("testx:location-bucket")
print b.get_location()

  1. python getlocation.py

Related issues

Copied to rgw - Backport #21634: luminous: s3:GetBucketLocation bucket policy fails with 403 In Progress

History

#2 Updated by Matt Benjamin 3 months ago

  • Status changed from Testing to Pending Backport

#3 Updated by Nathan Cutler 2 months ago

  • Copied to Backport #21634: luminous: s3:GetBucketLocation bucket policy fails with 403 added

Also available in: Atom PDF