Ceph » rgw

The following sequence works at Pacific 16.2.9 despite object locked in COMPLIANCE retention mode:

1. On Ceph Pacific 16.2.9:
   aws s3api create-bucket --bucket test-bucket --object-lock-enabled-for-bucket
   aws s3api put-object-lock-configuration --bucket test-bucket --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":90}}}'
   aws s3api put-object --bucket test-bucket --body
   aws s3api put-object --bucket test-bucket --body test --key test {
   "ETag": "\"d8e8fca2dc0f896fd7cb4cb0031ba249\"",
   "VersionId": "7w87yIzrlhfuSjk0WXEepYwTjCccj.o"
   }
   aws s3api get-object-retention --bucket test-bucket --key test {
   "Retention": {
   "Mode": "COMPLIANCE",
   "RetainUntilDate": "2022-09-18T14:24:22.162530+00:00"
   }
   }
2. While specifying the version-id, it behaves as expected for the first time
   aws s3api delete-object --bucket test-bucket --key test --version-id 7w87yIzrlhfuSjk0WXEepYwTjCccj.o

An error occurred (AccessDenied) when calling the DeleteObject operation: forbidden by object lock

1. While omitting the version-id, it creates a delete-marker
   aws s3api delete-object --bucket test-bucket --key test {
   "DeleteMarker": true,
   "VersionId": "rSQ7bqeVK6vGFdFtyvbJDLHRGqiZSsm"
   }
2. Specifying the version-id again, allows for the deletion of the object
   aws s3api delete-object --bucket test-bucket --key test --version-id 7w87yIzrlhfuSjk0WXEepYwTjCccj.o {
   "VersionId": "7w87yIzrlhfuSjk0WXEepYwTjCccj.o"
   }

The same sequence against Amazon works as follows:
aws s3api create-bucket --bucket test-bucket --object-lock-enabled-for-bucket --create-bucket-configuration LocationConstraint=us-west-1 {
"Location": "http://test-bucket.s3.amazonaws.com/"
}
aws s3api put-object-lock-configuration --bucket test-bucket --object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":90}}}'
aws s3api put-object --bucket test-bucket --body test --key test{
"ETag": "\"c86a2cdc3faa3b074363f08624ea7ed8\"",
"VersionId": "AzK1HMbvTRe.ykK8Eo7bwwn1Cq.cF0hQ"
}
aws s3api get-object-retention --bucket test-bucket --key test --version-id AzK1HMbvTRe.ykK8Eo7bwwn1Cq.cF0hQ {
"Retention": {
"Mode": "COMPLIANCE",
"RetainUntilDate": "2022-09-18T12:03:22.086000+00:00"
}
}

1. On AWS both specifying and omitting the version-id behaves as expected
   aws s3api delete-object --bucket test-bucket --key test

An error occurred (AccessDenied) when calling the DeleteObject operation: Access Denied

aws s3api delete-object --bucket test-bucket --key test --version-id AzK1HMbvTRe.ykK8Eo7bwwn1Cq.cF0hQ

An error occurred (AccessDenied) when calling the DeleteObject operation: Access Denied