[HADOOP-15572] Test S3Guard ops with assumed roles & verify required permissions

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.1.0
• Component/s: fs/s3
• Assignee: Steve Loughran
• Reporter: Steve Loughran
• Created: 29/Jun/18 11:19
• Updated: 24/Jul/18 22:29
• Resolved: 24/Jul/18 22:29

Description

We haven't documented permissions for S3Guard (WiP of mine); when I try to test using the AssumedRoleCredentialProvider & a role nominally restricted to R/W of S3guard but not create/delete, I can still create and destroy buckets

Either I've got my list wrong, or how S3Guard sets up its auth isn't right & somehow falling back to the full role

Issue Links

• Is contained by: HADOOP-15583 Stabilize S3A Assumed Role support
• is related to: HADOOP-15569 Expand S3A Assumed Role docs
• relates to: HADOOP-15583 Stabilize S3A Assumed Role support
• supercedes: HADOOP-14592 ITestS3ATemporaryCredentials to cover all ddb metastore ops with session credentials