Ceph » rgw

https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html#mpuAndPermissions has the same text for CreateMultipart and CompleteMultipart:

You must be allowed to perform the s3:PutObject action on an object

for both RGWPutObj and RGWCompleteMultipart, we match the policy's Resource against an object arn like "arn:aws:s3:::testbucket/testobject":

  if (!verify_bucket_permission(this, s, ARN(s->object->get_obj()),
                                rgw::IAM::s3PutObject)) {

but for RGWInitMultipart, we use the bucket arn "arn:aws:s3:::testbucket":

  if (!verify_bucket_permission(this, s, rgw::IAM::s3PutObject)) {

as a result, policy like this will deny CreateMultipartUpload requests:

      {
         "Effect": "Allow",
         "Principal": {"AWS": "*"},
         "Action": "s3:PutObject",
         "Resource": "arn:aws:s3:::testbucket/*" 
      }