PowerScale OneFS 9.8.0.0 Web Administration Guide

PDF

Object ACL

S3 ACLs are a legacy access control mechanism that predates Identity and Access Management (IAM).

On OneFS objects, ACLs are translated to NTFS ACLs and stored on-disk. The table below lists the mapping of S3 grants to NTFS grants. The difference in the OneFSS3 implementation is that he WRITE grant is allowed on object ACLs. In S3, the WRITE grant has no meaning as the S3 protocol does not allow modifying objects.

The WRITE grant instead allows an object to be modified through other access protocols. For translating S3 ACLs to NTFS ACLs for the PUT object ACL operation, the translation of each entry occurs as shown in the table. The translation of the NTFS ACL to S3 ACL, as needed in the GET object ACL, some entries may not be shown. As NTFS ACLs have a richer set of grants, permissions that are not in the table are omitted. Deny ACEs are also omitted, as S3 ACLs do not support a deny entry.

Table 1. Mapping S3 Grants to NTFS GrantsThe following table maps the S3 grants to NTFS grants.
S3 ACL	NTFS Permissions
READ	SYNCHRONIZE \| READ_DATA \| READ_ATTR \| READ_EA
WRITE	SYNCHRONIZE \| WRITE_DATA \| WRITE_ATTR \| WRITE_EA \| APPEND_DATA
READ_ACP	READ_CONTROL
WRITE_ACP	WRITE_DAC
FULL_CONTROL	FILE_ALL_ACCESS

An S3 ACL can also have one of the following predefined groups as a grantee:

Authenticated Users: Any signed request is in this group.
All Users: Any request, signed or unsigned, is in this group.
Log Delivery Group: This group represents the log server that writes server access logs in the bucket.

Object ACLs translate to the following S3 permissions:

Table 2. Equivalent S3 Permissions - Object ACLsThe following table displays the S3 permissions for each object ACL.
ACL	S3 Permissions
READ	s3:GetObject, s3:GetObjectVersion, s3:GetObjectTorrent
WRITE	Not Applicable
READ_ACP	s3:GetObjectAcl, s3:GetObjectVersionAcl
WRITE_ACP	s3:PutObjectAcl, s3:PutObjectVersionAcl
FULL_CONTROL	All the above

A difference in the OneFS implementation is the implicit owner ACE permission. In S3, the object owner is implicitly granted FULL_CONTROL, regardless of the ACL on the file. For OneFS to emulate this behavior, an ACE entry granting FULL_CONTROL to the object owner is appended to the end of any ACL set by S3.