Actions
Bug #69001
closedrgw/sts s3test failures when rgw_s3_auth_order puts local before sts
Status:
Duplicate
Priority:
Normal
Assignee:
-
Target version:
-
% Done:
0%
Source:
Backport:
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
ceph-qa-suite:
Pull request ID:
Tags (freeform):
sts s3
Merge Commit:
Fixed In:
Released In:
Upkeep Timestamp:
Description
=================================== FAILURES ===================================
________________ test_get_session_token_permanent_creds_denied _________________
...
try:
s3bucket = s3_client.create_bucket(Bucket=bucket_name)
except ClientError as e:
s3bucket_error = e.response.get("Error", {}).get("Code")
> assert s3bucket_error == 'AccessDenied'
E AssertionError: assert None == 'AccessDenied'
after that, several errors during teardown of other tests:
:==================================== ERRORS ====================================
______ ERROR at teardown of test_get_session_token_permanent_creds_denied ______
configfile = <class 'munch.Munch'>
@pytest.fixture(autouse=True)
def setup_teardown(configfile):
setup()
yield
> teardown()
...
s3tests_boto3/functional/__init__.py:297: in setup
nuke_prefixed_buckets(prefix=prefix, client=alt_client)
s3tests_boto3/functional/__init__.py:145: in nuke_prefixed_buckets
buckets = get_buckets_list(client, prefix)
s3tests_boto3/functional/__init__.py:56: in get_buckets_list
response = client.list_buckets()
...
E botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the ListBuckets operation: None
Updated by Casey Bodley over 1 year ago
the reason that test_get_session_token_permanent_creds_denied isn't getting AccessDenied from s3_client.create_bucket() is that we're passing valid access/secret keys that are accepted by the local engine:
s3_client=boto3.client('s3',
aws_access_key_id = s3_main_access_key,
aws_secret_access_key = s3_main_secret_key,
aws_session_token = response['Credentials']['SessionToken'],
endpoint_url=default_endpoint,
region_name='',
)
whereas the session token is associated with the alt_client with a user policy meant to Deny
can we omit the aws_access_key_id/aws_secret_access_key arguments here? i'm testing this in https://github.com/ceph/s3-tests/pull/604
Updated by Casey Bodley over 1 year ago
a separate question: with default rgw_s3_auth_order (sts before local), why didn't we fall back to the local engine and accept this request?
Updated by J. Eric Ivancich over 1 year ago
- Status changed from New to Duplicate
Updated by J. Eric Ivancich over 1 year ago
- Is duplicate of Bug #68393: s3 with keystone ec2 auth fails when rgw_s3_auth_order puts local before external added
Actions