Skip to content

HDDS-14894. [STS] Fix Latent S3 API Issue having No Acl Check for ListMultipartUploads#9971

Draft
fmorg-git wants to merge 9 commits intoapache:HDDS-13323-stsfrom
fmorg-git:HDDS-14894
Draft

HDDS-14894. [STS] Fix Latent S3 API Issue having No Acl Check for ListMultipartUploads#9971
fmorg-git wants to merge 9 commits intoapache:HDDS-13323-stsfrom
fmorg-git:HDDS-14894

Conversation

@fmorg-git
Copy link
Contributor

@fmorg-git fmorg-git commented Mar 25, 2026

Please describe your PR in detail:

  • Currently, there are no acl checks in the S3 ListMultipartUploads implementation. This affects STS because, for example, if a token is scoped to have only PutObject access, the token can also call ListMultipartUploads because there are no acl checks. This ticket adds the acl checks for STS requests because it is unclear how many users would be affected if acl checks were added to the base S3 apis.
  • This PR depends on HDDS-14861. [STS] Fix Latent S3 API issue when ListBuckets Missing a Required Permission #9949

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-14894

How was this patch tested?

unit tests, smoke tests

@fmorg-git fmorg-git force-pushed the HDDS-14894 branch 2 times, most recently from 7fd7a30 to 618decd Compare March 25, 2026 03:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant