+++ This bug was initially created as a clone of Red HatBug #2284153 +++ Description of problem: The customer exclusively uses STS/IAM roles for access to buckets and objects. In addition, they use session policies provided to AssumeRole calls to scope session permissions for our users. They are observing that when they provide a session policy of any kind, including one that provides all permissions, then the DeleteObjects call (batch delete) always returns AccessDenied for all keys. When they try to delete the same objects with DeleteObject (single delete) it works, so there is something about the batch delete operation that is impacting the access check as the policy does provide delete access to the objects in question. If they do the same operations with the same policy as role policy instead of session policy all operations pass as expected. The customer needs to get to the root cause of the permission discrepancy when using session policies for this API as this is critical to their use case of multi-user shared buckets with dynamic permissions. Version-Release number of selected component (if applicable): IBM Storage Ceph 7.0 How reproducible: Consistently Steps to Reproduce: Customer provided scripts that will be attached to BZ to reproduce Actual results: Batch delete do not function. Expected results: Batch delete should function as expected with session policy. Additional info:
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Red Hat Ceph Storage 8.0 security, bug fix, and enhancement updates), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2024:10216