Ceph » rgw

Whenever you specify subuser create with a secret key, iirc only the swift secret key is created.. the access key is just dropped as far as I understand... Do check if that is the case..

The behavior of the radosgw-admin CLI does allow this see this example (hammer). The issue is that the Admin REST API does not conform to this same behavior. There are some good use cases of creating subusers for S3 with the permission model.

[root@cephproxy00 ~]# radosgw-admin user create --uid=testuser --display-name="Test User" {
"user_id": "testuser",
"display_name": "Test User",
"email": "",
"suspended": 0,
"max_buckets": 1000,
"auid": 0,
"subusers": [],
"keys": [ {
"user": "testuser",
"access_key": "!REDACTED!",
"secret_key": "!REDACTED!"
}
],
"swift_keys": [],
"caps": [],
"op_mask": "read, write, delete",
"default_placement": "",
"placement_tags": [],
"bucket_quota": {
"enabled": false,
"max_size_kb": -1,
"max_objects": -1
},
"user_quota": {
"enabled": false,
"max_size_kb": -1,
"max_objects": -1
},
"temp_url_keys": []
}

[root@cephproxy00 ~]# radosgw-admin subuser create --uid=testuser --subuser=test1 --access-key=aaaaaaaaa --secret=zzzzzzzzz --access=read {
"user_id": "testuser",
"display_name": "Test User",
"email": "",
"suspended": 0,
"max_buckets": 1000,
"auid": 0,
"subusers": [ {
"id": "testuser:test1",
"permissions": "read"
}
],
"keys": [ {
"user": "testuser",
"access_key": "!REDACTED!",
"secret_key": "!REDACTED!"
}, {
"user": "testuser:test1",
"access_key": "aaaaaaaaa",
"secret_key": "zzzzzzzzz"
}
],
"swift_keys": [],
"caps": [],
"op_mask": "read, write, delete",
"default_placement": "",
"placement_tags": [],
"bucket_quota": {
"enabled": false,
"max_size_kb": -1,
"max_objects": -1
},
"user_quota": {
"enabled": false,
"max_size_kb": -1,
"max_objects": -1
},
"temp_url_keys": []
}