HDDS-14804. [STS] Part 3 - IAM Session Policy and ListBucket improvements#9896
Draft
fmorg-git wants to merge 3 commits intoapache:HDDS-13323-stsfrom
Draft
HDDS-14804. [STS] Part 3 - IAM Session Policy and ListBucket improvements#9896fmorg-git wants to merge 3 commits intoapache:HDDS-13323-stsfrom
fmorg-git wants to merge 3 commits intoapache:HDDS-13323-stsfrom
Conversation
fmorg-git
changed the title
fmorg-git
changed the title
added 3 commits
March 13, 2026 09:49
…ize against it Conflicts: hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/om/helpers/OmKeyArgs.java
Conflicts: hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/TestOMMetadataReader.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Please describe your PR in detail:
We need to be able to tell whether an S3 STS call is authorized for listing files in a bucket only vs being able to download a file, because those are different actions in S3 (ListBucket vs GetObject). To differentiate, use LIST at key/object level for listing permission and use READ at key/object level for downloading permission. Currently, the
OmMetadataReaderauthorizes only READ at key level for the listing operations. In order to not break existing functionality, have STS-specific checks that authorize against LIST permission instead. Further, because of how shallow listing works, in some cases (ex. root listing with a delimiter), it loses the context of what the original prefix was on the S3 request. For STS authorization, we need this original prefix, so introduce an optional listPrefix in the protocol to support this.Here are a quick summary of the total requisite changes:
s3:prefixCondition ands3:prefixis only applicable for ListBucket and ListBucketVersions (we don't support this).StringEqualsorStringLike) when using Conditions. If the operator isStringEqualsand a wildcard (* or ?) is used, ignore that condition since Ranger can’t authorize against literal asterisk or question mark.This part 3 PR is to change the IAM Session Policy Resolver to validate LIST permission on the key for ListBucket action instead of READ.
This PR depends on #9895.
What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-14804
How was this patch tested?
unit tests, smoke tests