[GitHub] [ozone] kerneltime commented on a diff in pull request #3552: HDDS-6949. Add audit of change bucket ACL S3 API.

[GitBox <gi...@apache.org>]

kerneltime commented on code in PR #3552:
URL: https://github.com/apache/ozone/pull/3552#discussion_r907572888


##########
hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/endpoint/BucketEndpoint.java:
##########
@@ -244,6 +244,8 @@ public Response put(@PathParam("bucket") String bucketName,
     try {
       if (aclMarker != null) {
         s3GAction = S3GAction.PUT_ACL;
+        AUDIT.logWriteSuccess(
+            buildAuditMessageForSuccess(s3GAction, getAuditParameters()));

Review Comment:
   The config is defined in https://github.com/apache/ozone/blob/master/hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/security/acl/OzoneAclConfig.java#L42-L48
   
   Which is used by the Rpc Client. https://github.com/apache/ozone/blob/master/hadoop-ozone/client/src/main/java/org/apache/hadoop/ozone/client/rpc/RpcClient.java#L221
   
   This is a bit awkward for 2 reasons, the actual string for configuration cannot be searched as plain test as the configuration splits it into 2 parts. Also, the defaults are set deep inside RpcClient vs being set close to the business logic in s3g. Ideally the group security setting should have been part of the Bucket Endpoint processing itself.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org