fmorg-git opened a new pull request, #10197:
URL: https://github.com/apache/ozone/pull/10197

   Please describe your PR in detail:
   * In order to restrict STS tokens on a fine-grained basis by action, each S3 
api needs to be associated with an S3 action. For example, both `HeadObject` 
and `GetObject` S3 apis are associated with "s3:GetObject" action. The actions 
will not have the s3: prefix when used internally in Ozone and Ranger.
   
   Most apis have a 1-1 mapping with api and action like the `HeadObject` and 
`GetObject` apis mentioned previously. In order to avoid having to update 
multiple call sites, an `S3GActionIamMapper` is introduced to leverage the 
already existing api audit functionality and map api names to actions in a 
thread local (`S3Authentication.getS3Action()`). Then in 
`OmMetadataReader.checkAcls()`, the `maybeAttachS3ActionFromThreadLocal` 
function is used to read the thread local and set the s3Action in the 
RequestContext if it exists.
   
   However, `CopyObject` and `UploadPartCopy` are special cases. There is no 
"s3:CopyObject" nor "s3:UploadPartCopy" action, but rather they both require 
"s3:GetObject" action on the source object and "s3:PutObject" action on the 
destination object. For these special cases, a helper method 
`runWithS3ActionString` is introduced in `EndpointBase.java` so the proper 
permissions can be checked on the source and on the destination by temporarily 
overriding the value in the thread local while the operation is invoked, then 
setting it back to the previous value when done.
   
   Additionally, this ticket contains additional fixes found after testing with 
these new changes.
   
   ## What is the link to the Apache JIRA
   https://issues.apache.org/jira/browse/HDDS-15137
   
   ## How was this patch tested?
   unit tests, smoke tests
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to