ceph 设置 bucket 的权限管理

环境：ceph 版本操作系统：ceph version 12.2.13 luminous ，centos7.6，s3cmd version 2.1.0

ceph 对象网关可以支持对 bucket 的权限管理

1、创建对象网关 user uat 和 uat2

radosgw-admin user create --uid=uat --display-name="For test"
radosgw-admin user create --uid=uat2 --display-name="For test"

2、配置好 s3cmd (s3cmd --configure), uat 使用默认的 .s3cfg，ust2 使用 .s3cfg.2，具体需要配置这几个参数

Access Key: 0MKBBALAM9C5UO7BP7M5
Secret Key: FtG7RAB1ya8hZNbdfnzosC8ZNb6Vqthc6xxVqIre
S3 Endpoint: 192.168.1.201:8080
Use HTTPS protocol [Yes]: NO
DNS-style bucket+hostname:port template for accessing a bucket [%(bucket)s.s3.amazonaws.com]: ''

3、uat 创建 bucket hehe，上传文件 s3://

s3cmd mb s3://hehe
s3cmd put a.txt s3://hehe/a.txt

4、uat 能查看到 s3://hehe/a.txt，uat2 无法查看到 ,报错 “AccessDenied”

[root@rgw01-backup ~]# s3cmd ls s3://hehe
2020-08-24 08:26           40  s3://hehe/a.txt

[root@rgw01-backup ~]# s3cmd -c .s3cfg.2 ls s3://hehe
ERROR: Access to bucket 'hehe' was denied
ERROR: S3 error: 403 (AccessDenied)

5、设置 bucket policy，授予 uat2 对 buckert hehe 的 ListBucket 和 GetObject 权限

[root@rgw01-backup ~]# cat acl1
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": ["s3:ListBucket", "s3:GetObject"],
            "Resource": [
                "arn:aws:s3:::hehe",
                "arn:aws:s3:::hehe/*"
            ],
            "Effect": "Allow",
            "Principal": {
                "AWS": ["arn:aws:iam:::user/uat2"]
            }
        }
    ]
}

[root@rgw01-backup ~]# s3cmd setpolicy acl1 s3://hehe

6、uat2 能查看到 s3://hehe/a.txt

[root@rgw01-backup ~]# s3cmd -c .s3cfg.2 ls s3://hehe
2020-08-24 08:26           40  s3://hehe/a.txt

7、撤销 policy

s3cmd delpolicy s3://hehe

参考文章：

https://docs.ceph.com/docs/luminous/radosgw/bucketpolicy/

https://docs.aws.amazon.com/AmazonS3/latest/dev/sse-c-using-java-sdk.html