Hi, I would suggest to run the aws cp command with --debug to see more details, the message "argument of type 'NoneType' is not iterable" is not really explanatory. ;-) Regards, Eugen "Rok Jaklič via ceph-users" ceph-users@ceph.io – 18. März 2026 10:53
Hi, I am trying to restrict subuser to its bucket (so he/she can work only on a bucket which has permission) with disabling ACLs and setting policy on a bucket: Using ceph version 19.2.2 bucket1-policy.json contains { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::tenant1:user/parent1:user1" }, "Action": "s3:*", "Resource": [ "arn:aws:s3:::bucket1", "arn:aws:s3:::bucket1/*" ] } ] } --- echo "lala" > test.txt export RGW_ENDPOINT="" radosgw-admin user create --tenant=tenant1 --uid=parent1 --key-type=s3 --display-name="tenant1:parent1" for sub in user1 user2 user3; do radosgw-admin subuser create --tenant=tenant1 --uid=parent1 --subuser=$sub --key-type=s3 --access=full; done export AWS_ACCESS_KEY_ID=$(radosgw-admin user info --uid="parent1" --tenant="tenant1" | jq .keys | jq -r '.[] | select(.user=="tenant1$parent1:user1").access_key') export AWS_SECRET_ACCESS_KEY=$(radosgw-admin user info --uid="parent1" --tenant="tenant1" | jq .keys | jq -r '.[] | select(.user=="tenant1$parent1:user1").secret_key') aws s3api create-bucket --bucket bucket1 --object-ownership BucketOwnerEnforced --endpoint-url $RGW_ENDPOINT aws s3api put-bucket-policy --bucket bucket1 --policy file://bucket1-policy.json --endpoint-url $RGW_ENDPOINT aws s3api put-public-access-block --bucket bucket1 --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true --endpoint-url $RGW_ENDPOINT aws s3 cp test.txt s3://bucket1/test.txt --endpoint-url $RGW_ENDPOINT aws s3 ls s3://bucket1 --endpoint-url $RGW_ENDPOINT # verify export AWS_ACCESS_KEY_ID=$(radosgw-admin user info --uid="parent1" --tenant="tenant1" | jq .keys | jq -r '.[] | select(.user=="tenant1$parent1:user2").access_key') export AWS_SECRET_ACCESS_KEY=$(radosgw-admin user info --uid="parent1" --tenant="tenant1" | jq .keys | jq -r '.[] | select(.user=="tenant1$parent1:user2").secret_key') aws s3 ls s3://bucket1 --endpoint-url $RGW_ENDPOINT --- Script stops at aws s3 cp test.txt s3://bucket1/test.txt --endpoint-url $RGW_ENDPOINT with an error like: upload failed: ./test.txt to s3://bucket1/test.txt argument of type 'NoneType' is not iterable If I comment the line with aws s3api put-public-access-block... I can successfully upload some file, but I can also see the contents of bucket1 with user2, which is not what I want. Any ideas how would I restrict the subuser to its bucket only? I was actually able to restrict subuser to its bucket by explicitly denying access to bucket with following policy: https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/message/AFNERFMNSC3... But it doesn't feel the right way. Wouldn't be better to "restrict" everything for everyone but its user in the first place and then allow others to access? Kind regards, Rok _______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io