Ceph » rgw

A customer of ours created a bucket on our RGW and had it configured by OpenShift. Part of this setup is the following PublicAccessBlockConfiguration:

$ aws s3api --bucket=foo get-public-access-block
{
    "PublicAccessBlockConfiguration": {
        "BlockPublicAcls": true,
        "IgnorePublicAcls": true,
        "BlockPublicPolicy": true,
        "RestrictPublicBuckets": true
    }
}

The full set of configuration steps applied by OpenShift can be found here:
https://github.com/openshift/cluster-image-registry-operator/blob/dec4ffeb7d84f6d7ec3fd222b82b8747d112528e/pkg/storage/s3/s3.go#L423-L447

With this configuration, it should not be possible to put objects whose ACL is private. That works.

However, putting objects with a private ACL should still work, but it does not:

$ aws s3api put-object --bucket=foo --key=bar --body=baz --acl=private
An error occurred (AccessDenied) when calling the PutObject operation: Unknown

If I set BlockPublicAcls to False, everything works as expected.

I checked this against an AWS bucket and there, the same public access block configuration works. I checked for other differences, but haven't found anything significant, though my understanding of this option is somewhat limited. Maybe there is a configuration that plays into this that I don't see.

From the looks of it though, it is as if the "private" ACL is not recognised as private.

If there's anything you'd like me to check, please let me know. I'm also happy to provide you with any kind of debug log that you need. This issue is easily reproducible for us.