Ceph » rgw

handling of bucket ARNs changed with iam account support, breaking some tenant/cross-tenant policy that wasn't covered in testing

for example, when a user in tenant1 creates a bucket and attaches policy to allow access for all principals:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Principal": {"AWS": "*"},
         "Action": "s3:*",
         "Resource": "arn:aws:s3:::*" 
      }
   ]
}

access to that bucket by a user in tenant2 is still rejected by bucket policy. as pointed out by @Pritha Srivastava, the policy's Resource ARN does not include the tenant name, but the ARN of the requested resource passed into policy evaluation does