Bug 1650405 - STS: S3 operations like DeleteBucket/PutObject Denied for RGW-user that assumes role of the primary user
Summary: STS: S3 operations like DeleteBucket/PutObject Denied for RGW-user that assum...
Alias: None
Product: Red Hat Ceph Storage
Classification: Red Hat
Component: RGW
Version: 3.2
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: 3.2
Assignee: Pritha Srivastava
QA Contact: Vidushi Mishra
Depends On:
TreeView+ depends on / blocked
Reported: 2018-11-16 06:00 UTC by Vidushi Mishra
Modified: 2019-01-03 19:02 UTC (History)
8 users (show)

Fixed In Version: RHEL: ceph-12.2.8-48.el7cp Ubuntu: ceph_12.2.8-43redhat1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2019-01-03 19:02:22 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:0020 0 None None None 2019-01-03 19:02:28 UTC

Description Vidushi Mishra 2018-11-16 06:00:27 UTC
Description of problem:

S3 operations like DeleteBucket/PutObject are denied for the user mentioned as the Principal in the assume role policy doc.

Version-Release number of selected component (if applicable):
ceph version 12.2.8-31redhat1xenial

How reproducible:

Steps to Reproduce:
1. Create a RGW user(TESTER) and assign admin caps to it for Role creation.
2. Create a role and allow another RGW user (TESTER1) to assume that role.
3. Attach a permission policy to the role which allows all s3 operation for all resources.
4. Do AssumeRole API call using TESTER1 credentials and perform some s3 operations.

Actual results:

S3 operations should not fail for the user that has assumed role and has permission policy for allowing all s3 operations.

Expected results:
S3 ops like deleteBucket and PutObject fail

Comment 4 Vidushi Mishra 2018-11-16 07:24:43 UTC
In the description of this BZ, please consider the Actual Results as Expected results and Expected results as Actual results.

Comment 7 Adam C. Emerson 2018-11-19 15:53:25 UTC
Surely, I'll be happy to.

Comment 8 Pritha Srivastava 2018-11-19 15:57:39 UTC
Matt, Adam, I am already looking into this. This is related to User Policy commits not there in downstream Luminous and few other bugs in user policy code.

Comment 19 errata-xmlrpc 2019-01-03 19:02:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.