Dell EMC ObjectScale 1.2.x Administration Guide

PDF

S3 request authorization

During the S3 request authorization process, ObjectScale evaluates permission using user, bucket, and object contexts as needed.


Context	Description
User	In this context, if the requester is an ObjectScale IAM principal, the principal must have permission from the parent account to which it belongs. In this step, the subset of policies that are owned by the parent account (also referred as the context authority) is evaluated. This subset of policies includes the user policy that the parent attaches to the principal. If the parent also owns the resource in the request (bucket, object), then the corresponding resource policies (bucket policy, bucket ACL, and object ACL) are also evaluated at the same time.
Bucket	In this context, ObjectScale evaluates policies that are owned by the account that owns the bucket. If the account that owns the object in the request is not same as the bucket owner, in the bucket context the policies are checked to verify that the bucket owner has not explicitly denied access to the object. If there is an explicit deny set on the object, then the request is not authorized.
Object	In this context, the requester must have permissions from the object owner to perform a specific object operation. In this step, the object ACL is evaluated if required.

Bucket authorization

In the S3 bucket operation authorization process, at first the system evaluates whether the requester is an IAM user. If yes, then the request is evaluated against the user context and the bucket contexts. If both verifications are authorized, the access is granted. Else, it is denied.

The below table describes the summary of access details for the same and cross account bucket operation:


Bucket owner (account)	Requestor (account, user)	Comments
A1	U1	The user or the bucket policy determines the access. There is no bucket ACL check.
A1	U2	U2 needs IAM policy from A2, if A1 bucket policy does not a make a determination, then the system checks the bucket ACL.
A1	R1	IAM policy is not relevant for root user (R1). If A1 bucket policy does not a make a determination, then the system checks the bucket ACL.
A1	R2	IAM policy is not relevant for root user (R2). If A1 bucket policy does not a make a determination, then the system checks the bucket ACL.
NOTE: In this table, the following legends are used: A1 = first account, A2 = second account, U1 = user from the first account, U2 = user from the second account, R1 = root user from the first account, and R2 = root user from the second account.

Object authorization

In the S3 object operation authorization process, at first the system evaluates whether the requester is an IAM user. If yes, then the request is evaluated against the user, bucket, and object contexts. If these three contexts verifications are authorized, the access is granted. Else, it is denied.

The below table describes the summary of access details for the same and cross account bucket operation:


Bucket owner (account)	Object owner (account)	Requestor	Comments
A1	A1	U1	Access is determined by the user and/or by the bucket policy. No object ACL check
A1	A1	U2	U2 needs IAM policy from A2 and if A1 bucket policy does not a make a determination, then the system checks the object ACL
A1	A1	R1	IAM policy not relevant for R1. If A1 bucket policy does not a make a determination, then the system checks the object ACL
A1	A1	R2	IAM policy not relevant for R2. If A1 bucket policy does not a make a determination, then the system checks the object ACL
A1	A2	U1	U1 needs IAM policy or bucket policy allow. Object ACL must allow A1 access.
A1	A2	U2	U2 needs IAM policy allow. Bucket policy should not deny. NOTE: Bucket policy cannot allow access.
A1	A2	U3	U3 needs IAM policy allow. Bucket policy should not deny. Object ACL must allow A3 access. NOTE: Bucket policy cannot allow access.
A1	A2	R1	IAM policy not relevant. Bucket policy should not deny. Object ACL needs to allow A1 access. NOTE: Bucket policy cannot allow access.
A1	A2	R2	IAM policy not relevant. Bucket policy should not deny. Object ACL must allow A2 access. NOTE: Bucket policy cannot allow access.
A1	A2	R3	IAM policy not relevant. Bucket policy should not deny. Object ACL must allow A3 access. NOTE: Bucket policy cannot allow access.
NOTE: In this table, the following legends are used: A1 = first account, A2 = second account, A3 = third account, U1 = user from the first account, U2 = user from the second account, U3 = user from the third account, R1 = root user from the first account, R2 = root user from the second account, and R3 = root user from the third account.