Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2017:3387
Description of problem: After setting the policy, configure_website() and get_website_configuration() fail to work. Version-Release number of selected component (if applicable): ceph-radosgw-12.2.0-2.el7cp.x86_64 How reproducible: Always Steps to Reproduce: 1. Create a bucket with tenant user testx$tester 2. Write a bucket policy providing s3:GetBucketWebsite/s3:PutBucketWebsite to another user in the same or different tenant 3. After setting the policy, try enabling/getting static website configuration on the bucket Actual results: S3ResponseError: 403 Forbidden Expected results: Website configuration should work Additional info: { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": {"AWS": ["arn:aws:iam::testy:user/u2"]}, "Action": ["s3:ListBucket", "s3:PutObject", "s3:GetBucketWebsite", "s3:PutBucketWebsite"], "Resource": [ "arn:aws:s3::*:s3website", "arn:aws:s3::*:s3website/*" ] }] } # s3cmd -c s3test.cfg setpolicy getwebsite s3://s3website #s3website.py website_bucket = conn.get_bucket("testx:s3website") index_key = website_bucket.new_key('index.html') index_key.content_type = 'text/html' index_key.set_contents_from_filename('index.html',policy='public-read') website_bucket.configure_website('index.html') website_bucket.get_website_configuration() Traceback (most recent call last): File "s3website.py", line 18, in <module> website_bucket.configure_website('index.html') boto.exception.S3ResponseError: S3ResponseError: 403 Forbidden <?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><BucketName>s3website</BucketName> /testx:s3website/?website 2017-09-20 06:08:51.519574 7f4d7c9b0700 15 server signature=d4Pp9Y6P+U6xJEnTE5ZJxS3XIMg= 2017-09-20 06:08:51.519574 7f4d7c9b0700 15 client signature=d4Pp9Y6P+U6xJEnTE5ZJxS3XIMg= 2017-09-20 06:08:51.519575 7f4d7c9b0700 15 compare=0 2017-09-20 06:08:51.519579 7f4d7c9b0700 20 rgw::auth::s3::LocalEngine granted access 2017-09-20 06:08:51.519580 7f4d7c9b0700 20 rgw::auth::s3::AWSAuthStrategy granted access 2017-09-20 06:08:51.519582 7f4d7c9b0700 2 req 3:0.000126:s3:PUT /testx:s3website/:set_bucket_website:normalizing buckets and tenants 2017-09-20 06:08:51.519585 7f4d7c9b0700 10 s->object=<NULL> s->bucket=testx/s3website 2017-09-20 06:08:51.519587 7f4d7c9b0700 2 req 3:0.000131:s3:PUT /testx:s3website/:set_bucket_website:init permissions 2017-09-20 06:08:51.519603 7f4d7c9b0700 15 decode_policy Read AccessControlPolicy<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/200 6-03-01/"><Owner><ID>testx$tester</ID><DisplayName>Test User</DisplayName></Owner><AccessControlList><Grant><Grantee xmlns:xsi="http://www.w 3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser"><ID>testx$tester</ID><DisplayName>Test User</DisplayName></Grantee><Permission>FULL_ CONTROL</Permission></Grant></AccessControlList></AccessControlPolicy> 2017-09-20 06:08:51.519702 7f4d7c9b0700 2 req 3:0.000246:s3:PUT /testx:s3website/:set_bucket_website:recalculating target 2017-09-20 06:08:51.519707 7f4d7c9b0700 2 req 3:0.000251:s3:PUT /testx:s3website/:set_bucket_website:reading permissions 2017-09-20 06:08:51.519710 7f4d7c9b0700 2 req 3:0.000253:s3:PUT /testx:s3website/:set_bucket_website:init op 2017-09-20 06:08:51.519711 7f4d7c9b0700 2 req 3:0.000255:s3:PUT /testx:s3website/:set_bucket_website:verifying op mask 2017-09-20 06:08:51.519713 7f4d7c9b0700 20 required_mask= 2 user.op_mask=7 2017-09-20 06:08:51.519714 7f4d7c9b0700 2 req 3:0.000258:s3:PUT /testx:s3website/:set_bucket_website:verifying op permissions 2017-09-20 06:08:51.519716 7f4d7c9b0700 20 op->ERRORHANDLER: err_no=-13 new_err_no=-13 2017-09-20 06:08:51.519873 7f4d7c9b0700 2 req 3:0.000417:s3:PUT /testx:s3website/:set_bucket_website:op status=0 2017-09-20 06:08:51.519879 7f4d7c9b0700 2 req 3:0.000422:s3:PUT /testx:s3website/:set_bucket_website:http status=403 2017-09-20 06:08:51.519882 7f4d7c9b0700 1 ====== req done req=0x7f4d7c9aa190 op status=0 http_status=403 ====== 2017-09-20 06:08:51.519891 7f4d7c9b0700 20 process_request() returned -13 File "s3website.py", line 19, in <module> website_bucket.get_website_configuration() boto.exception.S3ResponseError: S3ResponseError: 403 Forbidden <?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><BucketName>s3website</BucketName>