[ceph-users] Restricting subuser to its bucket

18 Mar 2026

      Hi,

I am trying to restrict subuser to its bucket (so he/she can work only on a
bucket which has permission) with disabling ACLs and setting policy on a
bucket:

Using ceph version 19.2.2

bucket1-policy.json contains
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::tenant1:user/parent1:user1"
      },
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::bucket1",
        "arn:aws:s3:::bucket1/*"
      ]
    }
  ]
}

---

echo "lala" > test.txt

export RGW_ENDPOINT=""

radosgw-admin user create --tenant=tenant1 --uid=parent1 --key-type=s3
--display-name="tenant1:parent1"
for sub in user1 user2 user3; do
radosgw-admin subuser create --tenant=tenant1 --uid=parent1 --subuser=$sub
--key-type=s3 --access=full;
done

export AWS_ACCESS_KEY_ID=$(radosgw-admin user info --uid="parent1"
--tenant="tenant1" | jq .keys | jq -r '.[] |
select(.user=="tenant1$parent1:user1").access_key')
export AWS_SECRET_ACCESS_KEY=$(radosgw-admin user info --uid="parent1"
--tenant="tenant1" | jq .keys | jq -r '.[] |
select(.user=="tenant1$parent1:user1").secret_key')

aws s3api create-bucket --bucket bucket1 --object-ownership
BucketOwnerEnforced --endpoint-url $RGW_ENDPOINT
aws s3api put-bucket-policy --bucket bucket1 --policy
file://bucket1-policy.json --endpoint-url $RGW_ENDPOINT
aws s3api put-public-access-block --bucket bucket1
--public-access-block-configuration
BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
--endpoint-url $RGW_ENDPOINT

aws s3 cp test.txt s3://bucket1/test.txt --endpoint-url $RGW_ENDPOINT
aws s3 ls s3://bucket1 --endpoint-url $RGW_ENDPOINT

# verify
export AWS_ACCESS_KEY_ID=$(radosgw-admin user info --uid="parent1"
--tenant="tenant1" | jq .keys | jq -r '.[] |
select(.user=="tenant1$parent1:user2").access_key')
export AWS_SECRET_ACCESS_KEY=$(radosgw-admin user info --uid="parent1"
--tenant="tenant1" | jq .keys | jq -r '.[] |
select(.user=="tenant1$parent1:user2").secret_key')

aws s3 ls s3://bucket1 --endpoint-url $RGW_ENDPOINT

---

Script stops at aws s3 cp test.txt s3://bucket1/test.txt --endpoint-url
$RGW_ENDPOINT with an error like:
upload failed: ./test.txt to s3://bucket1/test.txt argument of type
'NoneType' is not iterable

If I comment the line with aws s3api put-public-access-block... I can
successfully upload some file, but I can also see the contents of bucket1
with user2, which is not what I want.

Any ideas how would I restrict the subuser to its bucket only?

I was actually able to restrict subuser to its bucket by explicitly denying
access to bucket with following policy:
https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/message/AFNERFMNSC3...

But it doesn't feel the right way. Wouldn't be better to "restrict"
everything for everyone but its user in the first place and then allow
others to access?

Kind regards,
Rok

[ceph-users] Restricting subuser to its bucket

Rok Jaklič