Bug 2313820

Description of problem:
BucketPolicy with s3:GetObjectAttributes permission alone is allowing other users to perform the operation without depending on s3:GetObject permission

but according to the below aws document:
https://docs.aws.amazon.com/cli/latest/reference/s3api/get-object-attributes.html

"If the bucket is not versioned, you need the s3:GetObject and s3:GetObjectAttributes permissions."



log snippet:

[cephuser@ceph-hsm-upgrade-4a6d8m-node6 ~]$ aws --endpoint-url http://10.0.64.24:80 s3api get-bucket-policy --bucket bkt1
{
    "Policy": "{\n   \"Statement\": [\n      {\n         \"Effect\": \"Allow\",\n         \"Principal\": \"*\",\n         \"Action\": [\"s3:GetObjectAttributes\"],\n         \"Resource\": \"arn:aws:s3:::*\"\n      }\n   ]\n}\n"
}
[cephuser@ceph-hsm-upgrade-4a6d8m-node6 ~]$ 
[cephuser@ceph-hsm-upgrade-4a6d8m-node6 ~]$ aws --endpoint-url http://10.0.64.24:80 --profile hsm2 s3api get-object-attributes --bucket bkt1 --key obj20MB --object-attributes "StorageClass" "ETag" "ObjectSize" "Checksum"
{
    "LastModified": "Fri, 13 Sep 2024 18:31:55 GMT",
    "ETag": "fee4441cc5d2334340a5aed7a5821535-3",
    "Checksum": {},
    "StorageClass": "STANDARD",
    "ObjectSize": 20000000
}
[cephuser@ceph-hsm-upgrade-4a6d8m-node6 ~]$ 




Version-Release number of selected component (if applicable):
ceph version 19.1.1-42.el9cp

How reproducible:
always

Steps to Reproduce:
1.deploy cluster on 8.0 with rgw daemon
2.create a bucket
3.PutBucketPolicy with s3:GetObjectAttributes in the action list
4.perform get-object-attributes from another user client, the request is successful. expected it fails as s3:GetObject is not present in the actions list.

Actual results:
s3:GetObjectAttributes permission alone is allowing other users to perform the operation without depending on s3:GetObject permission

Expected results:
expected s3:GetObject and s3:GetObjectAttributes permissions are required to perform the operation

Additional info: