Siyao Meng created HDDS-17274:
---------------------------------
Summary: Require READ on the bucket for listKeys, listSnapshot and
listSnapshotDiffJobs
Key: HDDS-17274
URL: https://issues.apache.org/jira/browse/HDDS-17274
Project: Apache Ozone
Issue Type: Improvement
Components: Ozone Manager
Reporter: Siyao Meng
Assignee: Siyao Meng
{{listKeys}} (and {{listKeysLight}}, which calls it), {{listSnapshot}} and
{{listSnapshotDiffJobs}} check only LIST on the bucket. HDDS-17097 makes bucket
root {{listStatus}} and snapshot diff check both READ and LIST on the bucket,
which matches the Ranger permissions for listing keys (bucket LIST and READ).
This change also checks READ on the bucket for these three RPCs. Requests with
STS credentials are unchanged ({{listKeys}} already checks READ on the prefix
for them).
Compatibility:
- No protocol or layout change.
- A principal with LIST but not READ on a bucket can no longer list its keys,
snapshots or snapshot diff jobs. Clients usually call {{getBucketInfo}} before
listing, which already needs bucket READ, so most callers are not affected.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
