Bug #21582
closeds3:GetBucketLocation bucket policy fails with 403
0%
Description
After setting the policy, get_location() on the bucket fails to work.
Version-Release number of selected component (if applicable):
ceph-radosgw-12.2.0-2.el7cp.x86_64
How reproducible:
Always
Steps to Reproduce:
1. Create a bucket with tenant user testx$tester
2. Write a bucket policy providing s3:GetBucketLocation to another user in the same or different tenant
3. After setting the policy, try doing a get_location() on the bucket with the permitted user credentials.
Actual results:
S3ResponseError: 403 Forbidden
Additional info:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"AWS": ["arn:aws:iam::testy:user/u2"]},
"Action": ["s3:ListBucket", "s3:GetBucketLocation"],
"Resource": [
"arn:aws:s3::*:location-bucket",
"arn:aws:s3::*:location-bucket/*"
]
}]
}
b = conn.get_bucket("testx:location-bucket")
print b.get_location()
- python getlocation.py
Updated by Adam Emerson over 6 years ago
Updated by Matt Benjamin over 6 years ago
- Status changed from 7 to Pending Backport
Updated by Nathan Cutler over 6 years ago
- Copied to Backport #21634: luminous: s3:GetBucketLocation bucket policy fails with 403 added
Updated by Adam Emerson over 6 years ago
- Status changed from Pending Backport to Resolved