[ https://issues.apache.org/jira/browse/HADOOP-15572?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16527491#comment-16527491 ]
Steve Loughran commented on HADOOP-15572: ----------------------------------------- no, wrong role. {code} Caused by: com.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException: User: arn:aws:sts::980678866538:assumed-role/stevel-s3-restricted/stevel is not authorized to perform: dynamodb:DeleteTable on resource: arn:aws:dynamodb:eu-west-1:980678866538:table/hwdev-steve-ireland-new (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException; Request ID: 7SAGBN3SLO5J54FRCFG4V0FQGRVV4KQNSO5AEMVJF66Q9ASUAAJG) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1639) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1304) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1056) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:743) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:717) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699) at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667) at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649) at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.doInvoke(AmazonDynamoDBClient.java:2925) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.invoke(AmazonDynamoDBClient.java:2901) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.executeDeleteTable(AmazonDynamoDBClient.java:1143) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.deleteTable(AmazonDynamoDBClient.java:1119) at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.deleteTable(AmazonDynamoDBClient.java:1155) at com.amazonaws.services.dynamodbv2.document.Table.delete(Table.java:587) at org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStore.destroy(DynamoDBMetadataStore.java:796) ... 5 more {code} > Test S3Guard ops with assumed roles & verify required permissions > ----------------------------------------------------------------- > > Key: HADOOP-15572 > URL: https://issues.apache.org/jira/browse/HADOOP-15572 > Project: Hadoop Common > Issue Type: Sub-task > Components: fs/s3 > Affects Versions: 3.1.0 > Reporter: Steve Loughran > Priority: Major > > We haven't documented permissions for S3Guard (WiP of mine); when I try to > test using the AssumedRoleCredentialProvider & a role nominally restricted to > R/W of S3guard *but not create/delete*, I can still create and destroy buckets > Either I've got my list wrong, or how S3Guard sets up its auth isn't right & > somehow falling back to the full role -- This message was sent by Atlassian JIRA (v7.6.3#76005) --------------------------------------------------------------------- To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org