Ceph » rgw

Note: I also just tried (on Ceph),

aws s3 cp s3://bucket/non-existent-file.txt non-existent-file.txt

after assuming the role.

I get a 403 Forbidden, as apparently the 'cp' command does head-object first. As such, with s3:ListBucket implied by s3:*), I would expect a 404 Not Found.

Hi all.

PR https://github.com/ceph/s3-tests/pull/389 has role-policy

role_policy = '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Principal":"*","Resource":"arn:aws:s3:::*"}}'

I patched ceph 14.2.21 and tested role-policy :

role_policy = '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::bucket-1","arn:aws:s3:::bucket-1/*"]}}'

It not working.

I changed role-policy to :

role_policy = '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Principal":"*","Resource":["arn:aws:s3:::bucket-1","arn:aws:s3:::bucket-1/*"]}}'

It works.

Why "Principal":"*" must be include policy.

Thanks.

I tested this on octopus 15.2.14. Without Principal: "*" in the role policy, I still get a 403 when trying to access an object that doesn't exist after assuminmg a role with the proper s3 permissions.

If I add Principal: "*", I get a 404, which is what I would expect for a non-existent object after assuming the role

On pacific, 16.2.5, I still get a 403 on a non-existent object whether Principal is in the role policy or not... I expect a 404.

On AWS I DO NOT have to add the Principal: "*" to get this to work!

ok, i see from https://tracker.ceph.com/issues/50642 that this is scheduled for pacific 16.2.6. But the difference with AWS above remains. Thanks