fmorg-git commented on code in PR #10108:
URL: https://github.com/apache/ozone/pull/10108#discussion_r3127261587
##########
hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/security/acl/AssumeRoleRequest.java:
##########
@@ -93,10 +95,22 @@ public int hashCode() {
public static class OzoneGrant {
private final Set<IOzoneObj> objects;
private final Set<IAccessAuthorizer.ACLType> permissions;
+ /**
+ * S3 action names (e.g. s3:GetObject) from the session policy. When
present, the permissions will be further
Review Comment:
updated (made corresponding change in `RequestContext` as well)
##########
hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/security/acl/AssumeRoleRequest.java:
##########
@@ -93,10 +95,22 @@ public int hashCode() {
public static class OzoneGrant {
private final Set<IOzoneObj> objects;
private final Set<IAccessAuthorizer.ACLType> permissions;
+ /**
+ * S3 action names (e.g. s3:GetObject) from the session policy. When
present, the permissions will be further
+ * restricted by the set of available S3 actions. An empty (or null) set
means all actions granted by the
+ * permissions are allowed for this OzoneGrant.
+ */
+ private final Set<String> s3Actions;
public OzoneGrant(Set<IOzoneObj> objects, Set<IAccessAuthorizer.ACLType>
permissions) {
+ this(objects, permissions, Collections.emptySet());
Review Comment:
updated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
