ObjectACL, BucketACL not quite correct behavior #424

New issue

Open

opened 2025-12-28 17:37:21 +00:00 by sami · 3 comments

sami commented

2025-12-28 17:37:21 +00:00

Owner

Originally created by @evgeniiz321 on GitHub (Nov 11, 2023).

https://docs.aws.amazon.com/AmazonS3/latest/userguide/managing-acls.html

Bucket and object permissions are independent of each other. An object does not inherit the permissions from its bucket. For example, if you create a bucket and grant write access to a user, you can't access that user’s objects unless the user explicitly grants you access.

Create bucket with public-read-write ACL
Create object1 with public-read-write ACL
Create object2 without ACL (by default, access should be allowed only by an object owner)
Try to get/put obj2 from a not owner - access allowed, but should be denied

Seems to be related to https://github.com/nspcc-dev/neofs-s3-gw/issues/904, but this one is a more general issue.

Originally created by @evgeniiz321 on GitHub (Nov 11, 2023). https://docs.aws.amazon.com/AmazonS3/latest/userguide/managing-acls.html ``` Bucket and object permissions are independent of each other. An object does not inherit the permissions from its bucket. For example, if you create a bucket and grant write access to a user, you can't access that user’s objects unless the user explicitly grants you access. ``` 1. Create bucket with public-read-write ACL 2. Create object1 with public-read-write ACL 3. Create object2 without ACL (by default, access should be allowed only by an object owner) 4. Try to get/put obj2 from a not owner - access allowed, but should be denied Seems to be related to https://github.com/nspcc-dev/neofs-s3-gw/issues/904, but this one is a more general issue.

sami added the

bug

blocked

labels

2025-12-28 17:37:21 +00:00

sami commented

2025-12-28 17:37:22 +00:00

Author

Owner

@smallhive commented on GitHub (Nov 20, 2023):

I consider, bucket with public-read-write leads to object2 with public-read-write by default, according to the bucket rules

@smallhive commented on GitHub (Nov 20, 2023): I consider, `bucket with public-read-write` leads to `object2 with public-read-write` by default, according to the bucket rules

sami commented

2025-12-28 17:37:22 +00:00

Author

Owner

@roman-khimov commented on GitHub (Nov 20, 2023):

Yeah, that's somewhat strange and I'd expect object2 to be accessible. Is this behavior confirmed for AWS?

@roman-khimov commented on GitHub (Nov 20, 2023): Yeah, that's somewhat strange and I'd expect `object2` to be accessible. Is this behavior confirmed for AWS?

sami commented

2025-12-28 17:37:22 +00:00

Author

Owner

@roman-khimov commented on GitHub (Jun 18, 2024):

Similar to #904.

@roman-khimov commented on GitHub (Jun 18, 2024): Similar to #904.