fmorg-git commented on code in PR #11134: URL: https://github.com/apache/ozone/pull/11134#discussion_r3920646073
########## hadoop-hdds/docs/content/design/ozone-sts.md: ########## @@ -117,6 +117,15 @@ team agreed that behavior is fine for actions, but does not work for Conditions, restrict calls by sourceIp, and if we silently ignore this, the client may incorrectly think the temporary credentials are restricted for use by that IP address, so the consensus was to reject the request for that scenario. +### 3.3.2 Additional Context on Linked Buckets + +In Ozone, one may configure a chain of bucket links. In the scenario where one desires to call the AssumeRole api where the resource +is a linked bucket, ensure the Ranger policies for the role have the proper permissions for each link in the chain as well Review Comment: updated with 55d9adbe8e9c38d134ff324b3027bf289dd5c381 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
