[
https://issues.apache.org/jira/browse/HDDS-16486?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Meng-Shuan Tsai reassigned HDDS-16486:
--------------------------------------
Assignee: Meng-Shuan Tsai
> Support S3 Object Lock IAM action resolution and propagation to OM
> ------------------------------------------------------------------
>
> Key: HDDS-16486
> URL: https://issues.apache.org/jira/browse/HDDS-16486
> Project: Apache Ozone
> Issue Type: Sub-task
> Reporter: Chung-En Lee
> Assignee: Meng-Shuan Tsai
> Priority: Major
>
> To enforce fine-grained access control and compliance policies in Apache
> Ranger, S3 Gateway needs to identify incoming S3 Object Lock requests, map
> them to standard S3 IAM actions, and propagate the resolved action down to
> Ozone Manager for authorization.
> This task covers the mapping and propagation pipeline across
> {{{}s3gateway{}}}, {{{}common{}}}, and {{{}ozone-manager{}}}:
> # {*}Audit Actions ({{{}hadoop-ozone/s3gateway{}}}){*}:
> ** Extend {{S3GAction}} enum to include audit actions for all lock
> configuration operations:
> *** {{GET_BUCKET_OBJECT_LOCK_CONFIGURATION}}
> *** {{PUT_BUCKET_OBJECT_LOCK_CONFIGURATION}}
> *** {{GET_OBJECT_RETENTION}}
> *** {{PUT_OBJECT_RETENTION}}
> *** {{GET_OBJECT_LEGAL_HOLD}}
> *** {{PUT_OBJECT_LEGAL_HOLD}}
> *** {{BYPASS_GOVERNANCE_RETENTION}}
> # {*}IAM Action Mapping ({{{}hadoop-ozone/s3gateway{}}}){*}:
> ** Update {{S3GActionIamMapper}} to map the newly added {{S3GAction}}
> entries to corresponding standard IAM action strings:
> *** {{s3:GetBucketObjectLockConfiguration}}
> *** {{s3:PutBucketObjectLockConfiguration}}
> *** {{s3:GetObjectRetention}}
> *** {{s3:PutObjectRetention}}
> *** {{s3:GetObjectLegalHold}}
> *** {{s3:PutObjectLegalHold}}
> *** {{s3:BypassGovernanceRetention}}
> # {*}Action Registry & Scoping ({{{}hadoop-ozone/common{}}}){*}:
> ** Update {{IamSessionPolicyResolver.S3Action}} to register the new actions
> with appropriate resource scopes and primitive base permissions:
> *** Bucket-level: {{GetBucketObjectLockConfiguration}} ({{{}READ{}}}),
> {{PutBucketObjectLockConfiguration}} ({{{}WRITE{}}})
> *** Key-level: {{GetObjectRetention}} ({{{}READ{}}}), {{PutObjectRetention}}
> ({{{}WRITE{}}}), {{GetObjectLegalHold}} ({{{}READ{}}}),
> {{PutObjectLegalHold}} ({{{}WRITE{}}}), {{BypassGovernanceRetention}}
> ({{{}WRITE{}}} / {{{}DELETE{}}})
> # {*}RPC Propagation ({{{}hadoop-ozone/ozone-manager{}}}){*}:
> ** Ensure the resolved {{s3Action}} is serialized into {{S3Auth}} / OM
> request headers over RPC.
> ** Extract and bind {{s3Action}} into {{RequestContext.s3Action}} during OM
> request dispatching so that {{RangerOzoneAuthorizer}} can inspect it during
> policy evaluation.
> h4.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
