Bug 2344639

Description of problem:
public-access-block with BlockPublicAcls set on a Bucket is denying normal object upload without any public-acl in the request. 
but according to below aws document, it should block put_object only if the request includes a public ACL
https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

BlockPublicAcls	
Setting this option to TRUE causes the following behavior:

PUT Bucket acl and PUT Object acl calls fail if the specified access control list (ACL) is public.

PUT Object calls fail if the request includes a public ACL.

If this setting is applied to an account, then PUT Bucket calls fail if the request includes a public ACL.



log snippet:
able to upload objects before put-public-access-block and after delete-public-access-block. but when public-access-block is set "BlockPublicAcls=true", the normal object upload without any public-acl in the request is failing. but able to list the existing objects and download them. I have not set any other bucket acl or any bucket policy on the bucket.

[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ aws --endpoint-url http://10.0.67.62:80 --profile hsm s3 ls s3://bkt1
2025-02-07 12:22:47   10000000 obj10MB
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ 
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ aws --endpoint-url http://10.0.67.62:80 --profile hsm s3api put-public-access-block --bucket bkt1 --public-access-block-configuration "BlockPublicAcls=true"
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ 
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ aws --endpoint-url http://10.0.67.62:80 --profile hsm s3api get-public-access-block --bucket bkt1
{
    "PublicAccessBlockConfiguration": {
        "BlockPublicAcls": true,
        "IgnorePublicAcls": false,
        "BlockPublicPolicy": false,
        "RestrictPublicBuckets": false
    }
}
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ 
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ aws --endpoint-url http://10.0.67.62:80 --profile hsm s3 cp obj10MB s3://bkt1/obj1
upload failed: ./obj10MB to s3://bkt1/obj1 argument of type 'NoneType' is not iterable
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ 
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ aws --endpoint-url http://10.0.67.62:80 --profile hsm s3api delete-public-access-block --bucket bkt1
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ 
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ aws --endpoint-url http://10.0.67.62:80 --profile hsm s3api get-public-access-block --bucket bkt1

An error occurred (NoSuchPublicAccessBlockConfiguration) when calling the GetPublicAccessBlock operation: The public access block configuration was not found
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ 
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ aws --endpoint-url http://10.0.67.62:80 --profile hsm s3 cp obj10MB s3://bkt1/obj2
upload: ./obj10MB to s3://bkt1/obj2                             
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ 
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ aws --endpoint-url http://10.0.67.62:80 --profile hsm s3 ls s3://bkt1
2025-02-07 12:22:47   10000000 obj10MB
2025-02-07 12:30:34   10000000 obj2
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ 



found this error in rgw log:

2025-02-07T12:25:52.721+0000 7f37b0f34640 10 req 5256482051129602281 0.000000000s s3:abort_multipart evaluate_iam_policies: implicit deny from identity-based policy


Version-Release number of selected component (if applicable):
ceph version 19.2.0-73.el9cp

How reproducible:
always

Steps to Reproduce:
1.create a bucket
2.put-public-access-block with "BlockPublicAcls=true" on the bucket
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ aws --endpoint-url http://10.0.67.62:80 --profile hsm s3api put-public-access-block --bucket bkt1 --public-access-block-configuration "BlockPublicAcls=true"
3.try to upload an object without any public acl set in the request. it fails with AccessDenied
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ aws --endpoint-url http://10.0.67.62:80 --profile hsm s3 cp obj10MB s3://bkt1/obj1
upload failed: ./obj10MB to s3://bkt1/obj1 argument of type 'NoneType' is not iterable
[cephuser@ceph-hsm-dashboard-ijb2m6-node6 ~]$ 

Actual results:
put-object without any public-acl in the request is failing with AccessDenied

Expected results:
Expected put-object without any public-acl in the request is successful

Additional info:
rgw logs at debug level 20 is present here: http://magna002.ceph.redhat.com/cephci-jenkins/hsm/PR_public_access_block/ceph-client.rgw.rgw.all.ceph-hsm-dashboard-ijb2m6-node5.cikgdf.log

log output is captured in this doc: https://docs.google.com/document/d/1N5FOXCaPhTRd5VIDWtQv9P69afcjo2XiDcAWADVqDOc/edit?usp=sharing