[
https://issues.apache.org/jira/browse/HDDS-15984?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Fabian Morgan updated HDDS-15984:
---------------------------------
Description:
Currently, the following invalid session policy is being silently ignored
instead of rejected, so this ticket will improve the handling:
{code:json}
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":"s3:ListBucket",
"Resource":"arn:aws:s3:::my-bucket",
"Condition":{
"StringEquals":{
"s3:prefix":"logs/*",
"aws:username":"admin"
}
}
}
]
}
{code}
Separately, currently unsupported AssumeRole api parameters are being ignored
rather than being rejected. This ticket will improve that as well.
was:
Currently, the following invalid session policy is being silently ignored
instead of rejected, so this ticket will improve the handling:
{code:json}
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":"s3:GetObject",
"Resource":"arn:aws:s3:::iceberg/*",
"Condition":{
"StringEquals":{
"s3:prefix":"logs/*",
"aws:username":"admin"
}
}
}
]
}
{code}
Separately, currently unsupported AssumeRole api parameters are being ignored
rather than being rejected. This ticket will improve that as well.
> [STS] Improve s3:prefix Condition handling and reject unsupported AssumeRole
> parameters
> ---------------------------------------------------------------------------------------
>
> Key: HDDS-15984
> URL: https://issues.apache.org/jira/browse/HDDS-15984
> Project: Apache Ozone
> Issue Type: Sub-task
> Reporter: Fabian Morgan
> Assignee: Fabian Morgan
> Priority: Major
> Labels: pull-request-available
>
> Currently, the following invalid session policy is being silently ignored
> instead of rejected, so this ticket will improve the handling:
> {code:json}
> {
> "Version":"2012-10-17",
> "Statement":[
> {
> "Effect":"Allow",
> "Action":"s3:ListBucket",
> "Resource":"arn:aws:s3:::my-bucket",
> "Condition":{
> "StringEquals":{
> "s3:prefix":"logs/*",
> "aws:username":"admin"
> }
> }
> }
> ]
> }
> {code}
> Separately, currently unsupported AssumeRole api parameters are being ignored
> rather than being rejected. This ticket will improve that as well.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
