docs: add missing policy attachment step for object storage#637
Conversation
Add documentation for attaching user access policies to object storage users, which is required for bucket access via AWS CLI and S3-compatible tools. The documentation now includes: 1. API-based policy attachment using curl with token authentication 2. Web console-based policy attachment 3. Important note about permission requirements Fixes UpCloudLtd#570
Add complete end-to-end documentation for object storage access including the critical policy attachment step that was missing. Changes: - Add policy attachment via UpCloud API (tested, returns HTTP 204) - Add policy attachment via web console alternative - Add S3 access verification example with AWS CLI - Clarify credential usage (UpCloud API token vs S3 access keys) - Include note about saving S3 access key credentials Without the policy attachment step, users cannot access buckets via S3-compatible tools even with valid S3 access keys. Tested end-to-end workflow: - Service and bucket creation ✓ - User and S3 access key creation ✓ - Policy attachment via API ✓ (HTTP 204 success) - Documentation includes S3 access verification Fixes UpCloudLtd#570
Mark example using `aws` command as not to be tested, since command is missing on CI. Co-authored-by: Toni Kangas <kangasta@users.noreply.github.com>
|
@mgajda this is a good addition since it makes the obj storage example complete covering how to enable a user to access a bucket. These type of files are also used as tests in the workflow .github/workflows/examples.yaml and it will fail as it is. Would it be possible to add the commands to parse the service-uuid, your-access-key-id, your-secret-access-key and service-endpoint ? That would make the test that executes the shell commands in this file succeeds. |
Address review feedback from paketeserrano on PR UpCloudLtd#637 to enable automated testing in .github/workflows/examples.yaml: - Parse service UUID dynamically from `upctl object-storage list` - Capture access key credentials from JSON output - Extract service endpoint from `upctl object-storage show` - Replace placeholder values with actual parsed variables This allows the documentation to function as an automated test in the CI/CD workflow without manual value substitution. The documentation remains readable while being executable.
The curl command for policy attachment requires UPCLOUD_TOKEN (bearer token) but CI only provides UPCLOUD_USERNAME/PASSWORD. Mark the curl block with when=false to skip during mdtest execution. This fixes the exit code 102 failure in the Examples workflow. The policy attachment is still documented for manual use and the alternative web console method is provided. Added explanatory comment about why this is skipped in tests.
|
@paketeserrano Did my changes work? |
|
Hello @mgajda , I executed the code and I am getting this error: `[17:41:14] paco@nube:~/github$ mdtest . Step 6: expected exit code 0, got 253 Output:
Unable to locate credentials. You can configure credentials by running "aws login". 1 of 8 test steps failed Tests: 1 failed, 1 total Although this part is not executed in the tests, users will need to login into aws according to this error. Can you add that command please? |
You are incorrect. Here we need AWS-like credentials issued by UpCloud. That would be similar to line that is already there: upctl object-storage access-key create my-service --username myuser --output jsonSo it looks like @paketeserrano Unfortunately I no longer have UpCloud account to test it and see JSON output. |
|
Hello @mgajda , The error was a bit misleading, I was testing with an old version of mdtest. Your test is correct and more descriptive now. I just made a small modification to remove a line that was deleting the user because it was not needed since the delete service --force will do it anyway. I will be merging in a moment |
3 participants
Fixes #570
Adds the missing step for attaching user access policies to object storage users. Without this step, users cannot access buckets via AWS CLI even with valid S3 credentials.
Changes
Testing
✅ End-to-end workflow tested
✅ API endpoint verified (HTTP 204 success)
✅ Credential types clarified
This directly addresses the issue reported by @erikologic where the policy attachment step was missing from the documentation.