[jira] [Created] (HDDS-16486) Support S3 Object Lock IAM action resolution and propagation to OM

["Chung-En Lee (Jira)" <ji...@apache.org>]

Chung-En Lee created HDDS-16486:
-----------------------------------

             Summary: Support S3 Object Lock IAM action resolution and propagation to OM
                 Key: HDDS-16486
                 URL: https://issues.apache.org/jira/browse/HDDS-16486
             Project: Apache Ozone
          Issue Type: Sub-task
            Reporter: Chung-En Lee


To enforce fine-grained access control and compliance policies in Apache Ranger, S3 Gateway needs to identify incoming S3 Object Lock requests, map them to standard S3 IAM actions, and propagate the resolved action down to Ozone Manager for authorization.

This task covers the mapping and propagation pipeline across {{{}s3gateway{}}}, {{{}common{}}}, and {{{}ozone-manager{}}}:
 # {*}Audit Actions ({{{}hadoop-ozone/s3gateway{}}}){*}:

 ** Extend {{S3GAction}} enum to include audit actions for all lock configuration operations:

 *** {{GET_BUCKET_OBJECT_LOCK_CONFIGURATION}}

 *** {{PUT_BUCKET_OBJECT_LOCK_CONFIGURATION}}

 *** {{GET_OBJECT_RETENTION}}

 *** {{PUT_OBJECT_RETENTION}}

 *** {{GET_OBJECT_LEGAL_HOLD}}

 *** {{PUT_OBJECT_LEGAL_HOLD}}

 *** {{BYPASS_GOVERNANCE_RETENTION}}

 # {*}IAM Action Mapping ({{{}hadoop-ozone/s3gateway{}}}){*}:

 ** Update {{S3GActionIamMapper}} to map the newly added {{S3GAction}} entries to corresponding standard IAM action strings:

 *** {{s3:GetBucketObjectLockConfiguration}}

 *** {{s3:PutBucketObjectLockConfiguration}}

 *** {{s3:GetObjectRetention}}

 *** {{s3:PutObjectRetention}}

 *** {{s3:GetObjectLegalHold}}

 *** {{s3:PutObjectLegalHold}}

 *** {{s3:BypassGovernanceRetention}}

 # {*}Action Registry & Scoping ({{{}hadoop-ozone/common{}}}){*}:

 ** Update {{IamSessionPolicyResolver.S3Action}} to register the new actions with appropriate resource scopes and primitive base permissions:

 *** Bucket-level: {{GetBucketObjectLockConfiguration}} ({{{}READ{}}}), {{PutBucketObjectLockConfiguration}} ({{{}WRITE{}}})

 *** Key-level: {{GetObjectRetention}} ({{{}READ{}}}), {{PutObjectRetention}} ({{{}WRITE{}}}), {{GetObjectLegalHold}} ({{{}READ{}}}), {{PutObjectLegalHold}} ({{{}WRITE{}}}), {{BypassGovernanceRetention}} ({{{}WRITE{}}} / {{{}DELETE{}}})

 # {*}RPC Propagation ({{{}hadoop-ozone/ozone-manager{}}}){*}:

 ** Ensure the resolved {{s3Action}} is serialized into {{S3Auth}} / OM request headers over RPC.

 ** Extract and bind {{s3Action}} into {{RequestContext.s3Action}} during OM request dispatching so that {{RangerOzoneAuthorizer}} can inspect it during policy evaluation.

h4.  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org