You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "fmorg-git (via GitHub)" <gi...@apache.org> on 2026/10/05 21:26:17 UTC
[PR] HDDS-16724. Add support for missing S3 apis to STS [ozone]
fmorg-git opened a new pull request, #11413:
URL: https://github.com/apache/ozone/pull/11413
Please describe your PR in detail:
* The following implemented S3 apis are not currently supported in STS (for example in session policies):
1) Get/Put/Delete BucketTagging
2) Get/Put/Delete BucketLifecycle
3) GetObjectAttributes
This PR adds them.
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-16724
## How was this patch tested?
unit tests, smoke tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16724. Add support for missing S3 apis to STS [ozone]
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #11413:
URL: https://github.com/apache/ozone/pull/11413#issuecomment-6055853752
When merging PRs, please remove co-author information if it's the same person with different email address.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16724. Add support for missing S3 apis to STS [ozone]
Posted by "fmorg-git (via GitHub)" <gi...@apache.org>.
fmorg-git commented on PR #11413:
URL: https://github.com/apache/ozone/pull/11413#issuecomment-6004013994
fyi @ChenSammi @smengcl @Gargi-jais11
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16724. Add support for missing S3 apis to STS [ozone]
Posted by "fmorg-git (via GitHub)" <gi...@apache.org>.
fmorg-git commented on PR #11413:
URL: https://github.com/apache/ozone/pull/11413#issuecomment-6064062523
Thanks all for the review and merge.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16724. Add support for missing S3 apis to STS [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl merged PR #11413:
URL: https://github.com/apache/ozone/pull/11413
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16724. Add support for missing S3 apis to STS [ozone]
Posted by "fmorg-git (via GitHub)" <gi...@apache.org>.
fmorg-git commented on code in PR #11413:
URL: https://github.com/apache/ozone/pull/11413#discussion_r4201476701
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/ObjectAttributesHandler.java:
##########
@@ -124,6 +124,9 @@ Response handleGetRequest(ObjectRequestContext context, String keyPath)
OzoneKey key;
NavigableMap<Integer, Long> completedPartSizes = null;
try {
+ // AWS requires the credentials to support both s3:GetObject and s3:GetObjectAttributes actions. The
+ // main metadata request runs with GetObjectAttributes; perform the dependent GetObject check first.
+ requireS3ActionString("GetObject", () -> getClientProtocol().headS3Object(bucketName, keyPath));
Review Comment:
updated - ba56e04886b122adbafef6fb6d045ecb01831655
##########
hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3/endpoint/TestS3ActionOverrideForOwnerVerification.java:
##########
@@ -109,6 +126,31 @@ public void testCopyObjectDoesNotSetActionWhenStsDisabled() throws Exception {
assertNull(actionAtSourceBucketOwnerLookup.get());
}
+ @ParameterizedTest
+ @ValueSource(strings = {"ETag", "ObjectParts"})
+ public void testGetObjectAttributesRequiresBothIamActions(String attribute) throws Exception {
Review Comment:
updated - ba56e04886b122adbafef6fb6d045ecb01831655
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16724. Add support for missing S3 apis to STS [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on code in PR #11413:
URL: https://github.com/apache/ozone/pull/11413#discussion_r4191472634
##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/ObjectAttributesHandler.java:
##########
@@ -124,6 +124,9 @@ Response handleGetRequest(ObjectRequestContext context, String keyPath)
OzoneKey key;
NavigableMap<Integer, Long> completedPartSizes = null;
try {
+ // AWS requires the credentials to support both s3:GetObject and s3:GetObjectAttributes actions. The
+ // main metadata request runs with GetObjectAttributes; perform the dependent GetObject check first.
+ requireS3ActionString("GetObject", () -> getClientProtocol().headS3Object(bucketName, keyPath));
Review Comment:
Does this add an extra OM RPC round trip to every GetObjectAttributes request when STS is enabled? Is there a way to check both required actions during the existing OM metadata lookup and avoid the second RPC?
##########
hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3/endpoint/TestS3ActionOverrideForOwnerVerification.java:
##########
@@ -109,6 +126,31 @@ public void testCopyObjectDoesNotSetActionWhenStsDisabled() throws Exception {
assertNull(actionAtSourceBucketOwnerLookup.get());
}
+ @ParameterizedTest
+ @ValueSource(strings = {"ETag", "ObjectParts"})
+ public void testGetObjectAttributesRequiresBothIamActions(String attribute) throws Exception {
Review Comment:
Could we add a denied GetObject check for both ETag and ObjectParts? Have the check throw PERMISSION_DENIED, assert AccessDenied, and verify that the subsequent attributes lookup is not attempted. The smoke tests cover missing permissions. This would verify the handler’s error translation and short-circuit directly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-16724. Add support for missing S3 apis to STS [ozone]
Posted by "smengcl (via GitHub)" <gi...@apache.org>.
smengcl commented on PR #11413:
URL: https://github.com/apache/ozone/pull/11413#issuecomment-6055661574
Thanks @fmorg-git for the patch. Thanks @rich7420 for the review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org