[#53] iam: Extend support s3 to native actions #53

Merged

dkirillov merged 1 commit from dkirillov/policy-engine:feature/extend_converter_s3_to_native_mapping into master

2024-02-26 14:29:04 +00:00

dkirillov commented

2024-02-26 09:26:34 +00:00

Member

Otherwise, granting s3:DeleteObject action to someone doesn't allow access though native protocol with error:
s3:

2024-02-26T11:48:33.936+0300    error   handler/util.go:46      request failed  {"status": 500, "request_id": "89900aa1-9953-4392-9498-c6386de13d88", "method": "DeleteObject", "bucket": "test", "object": "tmp", "description": "could not delete object", "error": "mark object removal via connection pool: failed to collect relatives: failed to get raw object header: head object via client s01.frostfs.devenv:8080: read object header via client: status: code = 1024 message = method HeadObject: NoRuleFound"}

frostfs-cli:

failed to get raw object header: read object header via client: status: code = 1024 message = method HeadObject: NoRuleFound

and granting explicitly s3:HeadObject didn't solve the problem (because aws doesn't have such action (I suppose we can support more granularity))

Otherwise, granting `s3:DeleteObject` action to someone doesn't allow access though native protocol with error: s3: ``` 2024-02-26T11:48:33.936+0300 error handler/util.go:46 request failed {"status": 500, "request_id": "89900aa1-9953-4392-9498-c6386de13d88", "method": "DeleteObject", "bucket": "test", "object": "tmp", "description": "could not delete object", "error": "mark object removal via connection pool: failed to collect relatives: failed to get raw object header: head object via client s01.frostfs.devenv:8080: read object header via client: status: code = 1024 message = method HeadObject: NoRuleFound"} ``` frostfs-cli: ``` failed to get raw object header: read object header via client: status: code = 1024 message = method HeadObject: NoRuleFound ``` and granting explicitly `s3:HeadObject` didn't solve the problem (because aws doesn't have such action (I suppose we can support more granularity))