Any user can create bucket on /s3v volume.

[unixsrv]

I faced an issue with limiting the ability to create buckets in S3. Any user can create a bucket on the volume s3v. Please advise how this can be restricted ?

[ChenSammi]

Do you use native ACL or Ranger for user authorization? If native ACL is used, could you please share the native ACLs assigned to volume s3v? Command "ozone sh volume getacl $volumeName" can be used to fetch the ACLs.

[unixsrv]

I use native ACL

Set in config:

<property>
        <name>ozone.acl.authorizer.class</name>
        <value>org.apache.hadoop.ozone.security.acl.OzoneNativeAuthorizer</value>
    </property>

    <property>
        <name>ozone.acl.enabled</name>
        <value>true</value>
    </property>

ACL:

`[ozone@node1 ~]$ ozone sh volume getacl /s3v
[ {
  "type" : "USER",
  "name" : "root",
  "aclScope" : "ACCESS",
  "aclList" : [ "ALL" ]
}, {
  "type" : "GROUP",
  "name" : "root",
  "aclScope" : "ACCESS",
  "aclList" : [ "ALL" ]
} ]`

[unixsrv]

I completely reinstalled it and now it seems to be working. The user cannot create, only Administrator s3g can, but when creating a bucket and granting permissions, the user receives an error:
ERROR: S3 error: 403 (AccessDenied): User doesn't have the right to access this resource. <Resource>listBuckets</Resource>

The sequence of commands that were executed:

`
ozone s3 getsecret -u=user1
ozone sh  volume create  /vol1
ozone sh  bucket  create  /vol1/bucket1
ozone sh bucket link /vol1/bucket1 /s3v/bucket1
ozone sh bucket addacl -a user:user1:a  /s3v/bucket1
`

Are there any additional actions needed to allow the user to see their bucket?

[unixsrv]

Sorry resolve problem

Set permisions:
To s3v volume:

[ {
  "type" : "WORLD",
  "name" : "WORLD",
  "aclScope" : "ACCESS",
  "aclList" : [ "READ", "LIST" ]
} ]

To volume:

[ {
  "type" : "USER",
  "name" : "user1",
  "aclScope" : "ACCESS",
  "aclList" : [ "ALL" ]
} ]

To volume bucket:

[ {
  "type" : "USER",
  "name" : "user1",
  "aclScope" : "ACCESS",
  "aclList" : [ "ALL" ]
} ]

All works. Thank you !!