Chung-En Lee created HDDS-16486:
-----------------------------------
Summary: Support S3 Object Lock IAM action resolution and
propagation to OM
Key: HDDS-16486
URL: https://issues.apache.org/jira/browse/HDDS-16486
Project: Apache Ozone
Issue Type: Sub-task
Reporter: Chung-En Lee
To enforce fine-grained access control and compliance policies in Apache
Ranger, S3 Gateway needs to identify incoming S3 Object Lock requests, map them
to standard S3 IAM actions, and propagate the resolved action down to Ozone
Manager for authorization.
This task covers the mapping and propagation pipeline across {{{}s3gateway{}}},
{{{}common{}}}, and {{{}ozone-manager{}}}:
# {*}Audit Actions ({{{}hadoop-ozone/s3gateway{}}}){*}:
** Extend {{S3GAction}} enum to include audit actions for all lock
configuration operations:
*** {{GET_BUCKET_OBJECT_LOCK_CONFIGURATION}}
*** {{PUT_BUCKET_OBJECT_LOCK_CONFIGURATION}}
*** {{GET_OBJECT_RETENTION}}
*** {{PUT_OBJECT_RETENTION}}
*** {{GET_OBJECT_LEGAL_HOLD}}
*** {{PUT_OBJECT_LEGAL_HOLD}}
*** {{BYPASS_GOVERNANCE_RETENTION}}
# {*}IAM Action Mapping ({{{}hadoop-ozone/s3gateway{}}}){*}:
** Update {{S3GActionIamMapper}} to map the newly added {{S3GAction}} entries
to corresponding standard IAM action strings:
*** {{s3:GetBucketObjectLockConfiguration}}
*** {{s3:PutBucketObjectLockConfiguration}}
*** {{s3:GetObjectRetention}}
*** {{s3:PutObjectRetention}}
*** {{s3:GetObjectLegalHold}}
*** {{s3:PutObjectLegalHold}}
*** {{s3:BypassGovernanceRetention}}
# {*}Action Registry & Scoping ({{{}hadoop-ozone/common{}}}){*}:
** Update {{IamSessionPolicyResolver.S3Action}} to register the new actions
with appropriate resource scopes and primitive base permissions:
*** Bucket-level: {{GetBucketObjectLockConfiguration}} ({{{}READ{}}}),
{{PutBucketObjectLockConfiguration}} ({{{}WRITE{}}})
*** Key-level: {{GetObjectRetention}} ({{{}READ{}}}), {{PutObjectRetention}}
({{{}WRITE{}}}), {{GetObjectLegalHold}} ({{{}READ{}}}), {{PutObjectLegalHold}}
({{{}WRITE{}}}), {{BypassGovernanceRetention}} ({{{}WRITE{}}} / {{{}DELETE{}}})
# {*}RPC Propagation ({{{}hadoop-ozone/ozone-manager{}}}){*}:
** Ensure the resolved {{s3Action}} is serialized into {{S3Auth}} / OM request
headers over RPC.
** Extract and bind {{s3Action}} into {{RequestContext.s3Action}} during OM
request dispatching so that {{RangerOzoneAuthorizer}} can inspect it during
policy evaluation.
h4.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
