PowerScale OneFS 9.2.1.0 CLI Administration Guide

PDF

Object ACL

S3 ACLs are a legacy access control mechanism that predates Identity and Access Management (IAM).

On OneFSobjects, ACLs are translated to NTFS ACLs and stored on-disk. The table below lists the mapping of S3 grants to NTFS grants. The difference in the OneFSS3 implementation is the WRITE grant is allowed on object ACLs. In S3, the WRITE grant has no meaning as the S3 protocol does not allow modifying objects.

The WRITE grant instead allows an object to be modified through other access protocols. For translating S3 ACLs to NTFS ACLs for operations PUT object ACL, the translation of each entry happens as shown in the table. The translation of NTFS ACL to S3 ACL, as needed in the GET object ACL some entries may not be shown. As NTFS ACLs have a richer set of grants, permissions that are not in the table are omitted. Deny ACEs are also omitted as S3 ACLs do not support a deny entry.

Table 1. Mapping S3 grants to NTFS grantsThis table maps the S3 grants to NTFS grants
S3 ACL	NTFS Permissions
READ	SYNCHRONIZE \| READ_DATA \| READ_ATTR \| READ_EA
WRITE	SYNCHRONIZE \| WRITE_DATA \| WRITE_ATTR \| WRITE_EA \| APPEND_DATA
READ_ACP	READ_CONTROL
WRITE_ACP	WRITE_DAC
FULL_CONTROL	FILE_ALL_ACCESS

An S3 ACL can also have one of the following pre-defined groups as a grantee:

Authenticated Users: Any signed request is included in this group.
All Users: Any request, signed or unsigned, is included in this group.
Log Delivery Group: This group represents the log server that writes server access logs in the bucket.

Object ACLs translate to the following S3 permissions:

Table 2. Equivalent S3 Permissions - Object ACLs
ACL	S3 Permissions
READ	s3:GetObject, s3:GetObjectVersion, s3:GetObjectTorrent
WRITE	Not Applicable
READ_ACP	s3:GetObjectAcl, s3:GetObjectVersionAcl
WRITE_ACP	s3:PutObjectAcl, s3:PutObjectVersionAcl
FULL_CONTROL	All of the above

A difference in the OneFS implementation is the implicit owner ACE permission. In S3 the object owner is implicitly granted FULL_CONTROL, regardless of the ACL on the file. On OneFS to emulate this behavior, an ace entry granting FULL_CONTROL to the object owner is appended to the end of any ACL set by S3 which does not grant the owner FULL_CONTROL privilege.