Ceph » rgw

When "authenticated-read" ACL is applied on a bucket; anonymous user is also able to read (eg. list) the bucket. But as per S3 documentation only authenticated users should be allowed to access the bucket.

For example, using python boto, using the below code, any anonymous user is able to list the bucket using the public url

@
import boto
import requests
import boto.s3.connection
from boto import exception
access_key = '8d52e5231eed4a899220e7e85affd840'
secret_key = '03ad4895c4f9465aa57ff8d116d9eebb'
boto.config.add_section("Boto")
boto.config.set("Boto", "num_retries", "1")
conn = boto.connect_s3(
aws_access_key_id = access_key,
aws_secret_access_key = secret_key,
port=80,
host = 'localhost',
is_secure=True,
calling_format = boto.s3.connection.OrdinaryCallingFormat(),
debug=1
)

bucket = conn.create_bucket("new_cont1")
bucket.set_canned_acl('authenticated-read')
key = bucket.new_key("one")
key.set_contents_from_string("testing bucket level acl")
url = bucket.generate_url(3600)
l = url.split("/")
url = l⁰ + "/" + "/" + l² + "/" + l³
r = requests.get(url)
data = r.text
print data
assert (r.status_code == 403)
@