Bug 2293233
| Summary: | [rgw][sts][sns]: without permission for sns:CreateTopic in role or session policy, create topic operation succeded with sts creds | ||
|---|---|---|---|
| Product: | [Red Hat Storage] Red Hat Ceph Storage | Reporter: | Hemanth Sai <hmaheswa> |
| Component: | RGW | Assignee: | Pritha Srivastava <prsrivas> |
| Status: | CLOSED ERRATA | QA Contact: | Hemanth Sai <hmaheswa> |
| Severity: | high | Docs Contact: | Rivka Pollack <rpollack> |
| Priority: | unspecified | ||
| Version: | 7.1 | CC: | ceph-eng-bugs, cephqe-warriors, mbenjamin, mkasturi, prsrivas, rpollack, tserlin, ylifshit |
| Target Milestone: | --- | ||
| Target Release: | 9.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ceph-20.1.0-26 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-01-29 06:48:20 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: Red Hat Ceph Storage 9.0 Security and Enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2026:1536 The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days or the product is inactive and locked |
Description of problem: without permission for sns:CreateTopic in role or session policy, create topic operation succeded with sts creds Version-Release number of selected component (if applicable): ceph version 18.2.1-194.el9cp How reproducible: always Steps to Reproduce: 1.create a user 2.add the role capability to the user 'lynna.271' 3.create a role and attach a role policy to allow all s3 actions [cephuser@ceph-hsm-71-8j01oc-node6 ~]$ radosgw-admin role get --role-name Admin { "RoleId": "e580b100-f2e9-4a45-8390-eceb1f05a1e8", "RoleName": "Admin", "Path": "/", "Arn": "arn:aws:iam:::role/Admin", "CreateDate": "2024-06-09T15:12:20.321Z", "MaxSessionDuration": 3600, "AssumeRolePolicyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":[\"arn:aws:iam:::user/DeleteTest\"]},\"Action\":[\"sts:AssumeRole\"]}]}", "PermissionPolicies": [ { "PolicyName": "Admin", "PolicyValue": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"s3:*\"],\"Resource\":[\"arn:aws:s3:::*\"]}]}" } ] } [cephuser@ceph-hsm-71-8j01oc-node6 ~]$ [cephuser@ceph-hsm-71-8j01oc-node6 ~]$ radosgw-admin role policy get --role-name Admin --policy-name Admin { "Permission policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"s3:*\"],\"Resource\":[\"arn:aws:s3:::*\"]}]}" } [cephuser@ceph-hsm-71-8j01oc-node6 ~]$ 4.Perform the assume role API call Obtain the session token generated from the assume role API call. [cephuser@ceph-hsm-71-8j01oc-node6 ~]$ aws --endpoint-url http://10.0.208.194:80 sts assume-role --role-arn arn:aws:iam:::role/Admin --role-session-name session20 --policy "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"s3:*\"],\"Resource\":[\"arn:aws:s3:::*\"]}]}" { "Credentials": { "AccessKeyId": "SBBVy4les3ZLuRtY4c3", "SecretAccessKey": "ADP74M3V7WD8DYV132Y7DKUYV08YO2BM1I1Q5C5", "SessionToken": "7F+3izLHdAqm1BaHRCDdgJYfLO0ccVsg75CcPcRzfB1ksoG5e8A7N+CZ/KjH+Ld0pp7H1vCtFG8SPFA4fAIFCh8TpQb3PAdwV054mc7yTOpKInyuB9LH9BUyZWVK3yWE7LytZQQ3jck+Jol4CKXGCNYm1O/3OpomPwalfiGDkebOS/lrxI+HzwA4q74WEYCg3GlasNAEu8VdIcFS/RJOZYj6cFUzxy5JQ9iuWBeFVkxa5Ul6/rbCB5KoOKJoMxRhQs6TjuWDnULAAXNfuNJBLgTYRv1mJVfrHhn70WjENy1q7+dBOIj1NbfeStbVnitXfv+iAhdDetsxeuiTV8tvIhjD6wHa9kMmt2yEjXdEfeom9ywqCwGsgAwdjZOa82/EaiZGjGNGa0J7oRiIFOIkhMMiFTHr3UMTQylxYELjUq68YfxhNEFPu/Kpz9B3QbUJwDw6J7UrBW0bwi/WVFdb+A==", "Expiration": "2024-06-20T09:24:40.846272720Z" }, "AssumedRoleUser": { "Arn": "arn:aws:sts:::assumed-role/Admin/session20" }, "PackedPolicySize": 0 } [cephuser@ceph-hsm-71-8j01oc-node6 ~]$ 5.Attempt to perform sns create-topic operation [cephuser@ceph-hsm-71-8j01oc-node6 ~]$ aws --endpoint-url http://10.0.208.194:80 sns create-topic --name=fishtopic1 --attributes='{"push-endpoint": "kafka://localhost:9092"}' { "TopicArn": "arn:aws:sns:default::fishtopic1" } [cephuser@ceph-hsm-71-8j01oc-node6 ~]$ Actual results: sns:CreateTopic is successful with sts creds without being allowed in role or session policy Expected results: sns:CreateTopic should not be successful with sts creds without being allowed in role or session policy Additional info: