Create an Object Storage User with No Delete Permission

Use this procedure to create an object storage user that can LIST, GET, PUT, but not DELETE objects in a bucket.

Red Cloud backend storage is Ceph. When Ceph is integrated with Openstack, Openstack maps each project to a Ceph user. So to achieve our objective, we need to:

  1. Create a new project if you don't already have one, and
  2. Configure a bucket to be readable and writable to the new project, but with a policy denying the s3:DeleteObject and s3:DeleteObjectVersion actions.

Prerequisites

  • Access to the project (proj_0001) that owns the bucket (bucket1).
  • Access to a different project (project_0002) in which users will have read, write, but not delete access to bucket1. If you don't have a second project, create a new one.
  • Working knowledge of the Openstack CLI client, and
  • Working knowledge of the s3cmd S3 client. Configuration instructions are here. In the following instructions, s3cfg.proj_0001 is the s3cmd configuration file for proj_0001, and s3cfg.proj_0002 is the s3cmd configuration file for proj_0002.

Procedures

  • Create a deny-delete-json file like this:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreventUserObjectDeletion",
      "Effect": "Deny",
      "Principal": {
        "AWS":["arn:aws:iam::<<proj_0002 ID>>:root"]
      },
      "Action": [
        "s3:DeleteObject",
        "s3:DeleteObjectVersion"
      ],
      "Resource":"arn:aws:s3:::bucket1/*"
    }
  ]
}

Substitute <<proj_0002 ID>> with the project ID of proj_0002. You can find the project ID on the Horizon web console via this URL: https://redcloud2.cac.cornell.edu/horizon/identity/.

Substitute bucket1 with the name of your bucket.

  • As a proj_0001 user, apply the policy in the deny-delete.json file to bucket1 and confirm: 
s3cmd -c s3cfg.proj_0001 setpolicy deny-delete.json s3://bucket1
s3cmd -c s3cfg.proj_0001 info s3://bucket1
  • Give the proj_0002 project read and write permission to bucket1 and confirm:
s3cmd -c s3cfg.proj_0001 setacl --acl-grant=read:<<proj_0002 ID>> s3://bucket1
s3cmd -c s3cfg.proj_0001 setacl --acl-grant=write:<<proj_0002 ID>> s3://bucket1
s3cmd -c s3cfg.proj_0001 info s3://bucket1
  • As a proj_0002 user, confirm you can read and write to bucket1 by uploading an object (test_file):
s3cmd -c s3cfg.proj_0002 put test_file s3://bucket1
s3cmd -c s3cfg.proj_0002 ls s3://bucket1
  • Confirm a proj_0002 user cannot delete the test object (test_file) from bucket1 but a proj_0001 user can: s3cmd -c s3cfg.proj_0002 rm s3://bucket1/test_file should return an error.

s3cmd -c s3cfg.proj_0001 rm s3://bucket1/test_file should delete the object.

You can now create additional ec2 credentials in proj_0002 with capabilities to read, write, but not delete objects in bucket1.