mneethiraj commented on code in PR #10108:
URL: https://github.com/apache/ozone/pull/10108#discussion_r3127054504
##########
hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/security/acl/AssumeRoleRequest.java:
##########
@@ -93,10 +95,22 @@ public int hashCode() {
public static class OzoneGrant {
private final Set<IOzoneObj> objects;
private final Set<IAccessAuthorizer.ACLType> permissions;
+ /**
+ * S3 action names (e.g. s3:GetObject) from the session policy. When
present, the permissions will be further
+ * restricted by the set of available S3 actions. An empty (or null) set
means all actions granted by the
+ * permissions are allowed for this OzoneGrant.
+ */
+ private final Set<String> s3Actions;
public OzoneGrant(Set<IOzoneObj> objects, Set<IAccessAuthorizer.ACLType>
permissions) {
+ this(objects, permissions, Collections.emptySet());
Review Comment:
line 113 creates a new `LinedHashSet` instance and a
`Collections.unmodifiable` instance from `Collections.emptySet()` passed here.
Consider avoiding this by directly assigning members here:
```
this.objects = objects;
this.permission = permissions;
this.s3Actions = Collections.emptySet();
```
##########
hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/security/acl/AssumeRoleRequest.java:
##########
@@ -93,10 +95,22 @@ public int hashCode() {
public static class OzoneGrant {
private final Set<IOzoneObj> objects;
private final Set<IAccessAuthorizer.ACLType> permissions;
+ /**
+ * S3 action names (e.g. s3:GetObject) from the session policy. When
present, the permissions will be further
+ * restricted by the set of available S3 actions. An empty (or null) set
means all actions granted by the
Review Comment:
> means all actions granted by the permissions are allowed
This implies that each permission maps to specific actions. While this is
true at S3 gateway implementation, this is not formally documented, right? I
suggest replacing this text with:
> means the grant does not enforce any restructions on actions
##########
hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/security/acl/AssumeRoleRequest.java:
##########
@@ -93,10 +95,22 @@ public int hashCode() {
public static class OzoneGrant {
private final Set<IOzoneObj> objects;
private final Set<IAccessAuthorizer.ACLType> permissions;
+ /**
+ * S3 action names (e.g. s3:GetObject) from the session policy. When
present, the permissions will be further
Review Comment:
Given the field name is `s3Actions`, I suggest dropping prefix `s3:` in the
values.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
