Bug #66177: rgw: implement ConfirmRemoveSelfBucketAccess header for bucket policy - rgw - Ceph

Actions

Copy link

Bug #66177

open

rgw: implement ConfirmRemoveSelfBucketAccess header for bucket policy

Added by Seena Fallah almost 2 years ago. Updated 6 months ago.

Status:

Pending Backport

Priority:

Normal

Assignee:

Seena Fallah

Target version:

% Done:

Source:

Community (dev)

Backport:

squid reef

Regression:

Severity:

3 - minor

Reviewed:

Affected Versions:

ceph-qa-suite:

Pull request ID:

57629

Tags (freeform):

backport_processed

Merge Commit:

3674e92f8d1e75151513c1e89637ea2a458d910e

Fixed In:

v20.0.0-603-g3674e92f8d

Released In:

v20.2.0~815

Upkeep Timestamp:

2025-11-22T00:46:30+00:00

Description

According to https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html

To ensure that bucket owners don't inadvertently lock themselves out of their own buckets, the root principal in a bucket owner's AWS account can perform the GetBucketPolicy, PutBucketPolicy, and DeleteBucketPolicy API actions, even if their bucket policy explicitly denies the root principal's access. Bucket owner root principals can only be blocked from performing these API actions by VPC endpoint policies and AWS Organizations policies.

By implementing the `x-amz-confirm-remove-self-bucket-access` header this privilege can also be dropped from the root user.

Related issues 2 (2 open — 0 closed)