Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

allow user role to create/list/delete buckets (but bucket policy still affects) #7336

Merged
merged 1 commit into from
Jun 12, 2023

Conversation

guymguym
Copy link
Member

Explain the changes

  1. Accounts with "user" role were rejected by the rpc auth from performing bucket operations - create, update, delete, list.
  2. Changed to allow it by the rpc.
  3. Still, the specific bucket policy and account options will only let users that are allowed per a bucket and account.
  4. For example create_bucket permission is based on account.allow_bucket_creation which can be specified in create_account api.

Issues: Fixed #xxx / Gap #xxx

  1. NA

Testing Instructions:

  1. Create an account with "user" role and use the account access/secret keys to perform bucket operations:
npm run api -- account create_account '{ "name":"alice", "email":"alice@noobaa.io", "has_login":false, "s3_access":true, "allow_bucket_creation":true, "roles":["user"], "default_resource":"backingstores" }' --json

export AWS_ACCESS_KEY_ID=$(npm run api -- account read_account '{"email":"alice@noobaa.io"}' --json | tail -1 | jq -r '.access_keys[0].access_key')
export AWS_SECRET_ACCESS_KEY=$(npm run api -- account read_account '{"email":"alice@noobaa.io"}' --json | tail -1 | jq -r '.access_keys[0].secret_key')

❯ aws s3 --endpoint http://localhost:6001 mb s3://alice-bucket1
make_bucket: alice-bucket1
❯ aws s3 --endpoint http://localhost:6001 ls
2023-06-12 10:33:41 alice-bucket1
❯ aws s3 --endpoint http://localhost:6001 ls s3://alice-bucket1
❯ aws s3 --endpoint http://localhost:6001 rb s3://alice-bucket1
remove_bucket: alice-bucket1
  • Doc added/updated
  • Tests added

…l affects)

Signed-off-by: Guy Margalit <guymguym@gmail.com>
@guymguym guymguym merged commit 23a8f82 into noobaa:master Jun 12, 2023
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants