Ceph » rgw

in rgw, whenever a bucket is created, it stores acl (default if none provided or custom or canned acl passed during create bucket or put_acl()) as bucket attrs.

The acls are stored as RGWAccessControlPolicy The data is stored across 2 members

RGWAccessControlList acl;
ACLOwner owner;

Both these members store the uid of the bucket-owner.
Now when the uid is migrated to account using below command, following code changes the owner of bucket and its acl to account id

radosgw-admin modify user --uid <user id> --account-id <acc_id>

however the bucket acls are not completely migrated as can seen here Its only migrating one member "ACLOwner owner" but did not migrate the "RGWAccessControlList acl"

The problem with this incomplete migration is, now when the migrated user (account) tries to call the CreateBucket() again it fails with error "Cannot modify existing access control policy" because the old_policy when loaded still contains the UID whereas the new request contains the ACCOUNT_ID and there is mismatch.