Unable to log in to console as non-admin user with username/password

[OCram85]

RustFS version: 1.0.0-beta.7

What I'm trying to do

I want to allow a regular (non-root) user to log in to the RustFS web console using their username and password, with access restricted to a single bucket.

What I've done

1. Created a user with a username and password via the web console.
2. Created and assigned the following policy to that user:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["admin:*"],
      "Resource": ["arn:aws:s3:::*"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::userbucket-a",
        "arn:aws:s3:::userbucket-a/*"
      ]
    }
  ]
}

3. On the console login page, I'm using the STS Login tab with the user's username and password. (Also tested with a valid access and secret key)

Problem

Login fails with "Login failed" every time. The root admin account continues to work fine.

Questions

• Is admin:* actually required for username/password (STS) login to work, or is there a minimal set of actions needed?
• Is there a specific policy structure required for non-admin users to authenticate via the console?
• Are there any known issues with non-admin console login in beta.7?

Any guidance or working policy examples would be greatly appreciated! 🙏

[UnknownHawkins]

Better to answer: The console login uses the "admin" API which requires the "admin:*" action only for admin users; non-admin must use "login" API which requires "iam:CreateLoginProfile" etc. Actually the issue is that the policy must

[VectorPeak]

admin:* should not be used for a bucket-scoped console user. It grants admin API permissions and is not the right way to allow access to a single bucket. Also, admin actions generally should not be scoped to arn:aws:s3:::... bucket resources; if they are supported, they usually apply to *, which would be too broad here.

Use a bucket policy like this for the non-admin user:

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetBucketLocation",
 "s3:ListBucket"
 ],
 "Resource": [
 "arn:aws:s3:::userbucket-a"
 ]
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:GetObject",
 "s3:PutObject",
 "s3:DeleteObject"
 ],
 "Resource": [
 "arn:aws:s3:::userbucket-a/*"
 ]
 }
 ]
}

The STS login tab may not be the right path for a local IAM user/password login. For a regular RustFS user, try logging in with that user’s access key and secret key instead of username/password. If access-key login also fails with this policy, that points more toward a console/auth bug or missing console-side permission in 1.0.0-beta.7, not an S3 bucket policy issue.

---

如果我的回答解决了您的问题，您可以点一下 answered the question，其实我是来解答问题，顺带着收集 Galaxy Brain 徽章的哈哈 😆