I'm trying to add allUsers user to one of my buckets with a condition. But it throws an exception and I don't know what is the problem.
My bucket uses uniform bucket-level access control. I follow these steps:
Click Permission
Add Members
New Members (allUsers)
Select a role Storage Object Viewer
Add condition resource.name.startswith('{my pattern}')
Click Save
And I get IAM policy update failed - backend error.
Do you have any idea why am I getting this exception?
For more detail:
I have 4 different folders(I mean virtual folders) in my root directory.
one of them starts with my pattern. The bucket has a lot of files but I tried the same changes for an empty bucket, nothing changed!
I just reproduced this and in effect, I wasn't able to set a condition to allUsers in my bucket but I was able to set conditions for specific users. Setting conditions to allUsers is not supported, you must specify a valid user or group
Related
Looking to READ (not modify) policies across a variety of projects/repositories/refnames (all elements that are query parameters to the call). However I am getting back empty result sets, even for repositories/branches I know have policies.... Using a test environment of my own (where I am Full Administrator) I get the expected results..
So what are the minimum permissions I must request to the production environments to harvest this information???
According to the results of my test, you need to set Project Settings => Repositories =>Policies =>Reserved names to on.
Then when you create Personal Access Tokens, you need to check the Read option of Code at least to get the correct response name "200 OK" and the complete result.
In addition, the user needs to have the reader permission of the project.
I would like to use the node sdk to implement a backup and restore mechanism between 2 instances of Cloud Object Storage. I have added a service ID to the instances and added a permissions for the service id to access the buckets present in the instance i want to write to. The buckets will be in different regions. I have tried a variety of endpoints both legacy and non-legacy private and public to achieve this but i usually get Access Denied.
Is what I am trying to do possible with the sdk? if so can someone point me in the right direction?
var config = {
"apiKeyId": "xxxxxxxxxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxx",
"endpoint": "s3.eu-gb.objectstorage.softlayer.net",
"iam_apikey_description": "Auto generated apikey during resource-key operation for Instance - crn:v1:bluemix:public:cloud-object-storage:global:a/xxxxxxxxxxx:xxxxxxxxxxx::",
"iam_apikey_name": "auto-generated-apikey-xxxxxxxxxxxxxxxxxxxxxx",
"iam_role_crn": "crn:v1:bluemix:public:iam::::serviceRole:Writer",
"iam_serviceid_crn": "crn:v1:bluemix:public:iam-identity::a/0xxxxxxxxxxxxxxxxxxxx::serviceid:ServiceIdxxxxxxxxxxxxxxxxxxxxxx",
"serviceInstanceId": "crn:v1:bluemix:public:cloud-object-storage:global:a/xxxxxxxxxxxxxxxxxxx:xxxxxxxxxxxxxxxxxxxxxxxxxx::",
"ibmAuthEndpoint": "iam.cloud.ibm.com/oidc/token"
}
This should work as long as you are able to properly grant the requesting user access to be able to read the source of the put-copy, so long as you are not using KeyProtect based keys.
So the breakdown here is a bit confusing due to some unintuitive terminology.
A service instance is a collection of buckets. The primary reason for having multiple instances of COS is to have more granularity in your billing, as you'll get a separate line item for each instance. The term is a bit misleading, however, because COS is a true multi-tenant system - you aren't actually provisioning an instance of COS, you're provisioning a sort of sub-account within the existing system.
A bucket is used to segment your data into different storage locations or storage classes. Other behavior, like CORS, archiving, or retention, acts on the bucket level as well. You don't want to segment something that you expect to scale (like customer data) across separate buckets, as there's a limit of ~1k buckets in an instance. IBM Cloud IAM treats buckets as 'resources' and are subject to IAM policies.
Instead, data that doesn't need to be segregated by location or class, and that you expect to be subject to the same CORS, lifecycle, retention, or IAM policies can be separated by prefix. This means a bunch of similar objects share a path, like foo/bar and foo/bas have the same prefix foo/. This helps with listing and organization but doesn't provide granular access control or any other sort of policy-esque functionality.
Now, to your question, the answer is both yes and no. If the buckets are in the same instance then no problem. Bucket names are unique, so as long as there isn't any secondary managed encryption (eg Key Protect) there's no problem copying across buckets, even if they span regions. Keep in mind, however, that large objects will take time to copy, and COS's strong consistency might lead to situations where the operation may not return a response until it's completed. Copying across instances is not currently supported.
I have a user performing a data import into Dynamics CRM. The partial error on the import says the user does not have enough privileges to access the Dynamics CRM Object for 2 lookup columns. One of them the user imported. The importer can see both the lookup list values. Can someone explain the proper permissions required for the user performing the data import?
You mentioned they can see, ie Read privilege. Check Write privilege as well.
Most importantly, Lookup attribute import needs AppendTo & Append privileges in respective entities.
When you are importing EntityA having EntityB lookup, importing User should have a security role with AppendTo in EntityA & Append in EntityB privileges + appropriate (user/BU level) access levels
Verify the AppendTo & Append privileges of those entities.
I assume you already verified these mentioned privileges.
Update:
Seems like custom Power user role (probably created from scratch) is throwing problems. Always start with cloning OOB security roles like salesperson & fill out the needed privileges. This helps to carry the hidden privileges.
Avoid giving highest privilege like Sys.Admin which will give users more than what needed, for ex. Bulk delete button will appear in Delete ribbon flyout & once my user configured Bulk delete job assuming record deletion action.
Atleast remove it once the import job is done.
How do I set access permissions for entire folder in storage bucket? Example; I have 2 folders (containing many subfolders/objects) in single bucket (let's call them folder 'A' and 'B') and 4 members in project team. All 4 members can have read/edit access for folder A but only 2 of the members are allowed to have access to folder 'B'. Is there a simple way to set these permissions for each folder? There are hundreds/thousands of files within each folder and it would be very time consuming to set permissions for each individual file. Thanks for any help.
It's very poorly documented, but search for "folder" in the gsutil acl ch manpage:
Grant the user with the specified canonical ID READ access to all objects in example-bucket that begin with folder/:
gsutil acl ch -r \
-u 84fac329bceSAMPLE777d5d22b8SAMPLE785ac2SAMPLE2dfcf7c4adf34da46:R \
gs://example-bucket/folder/
Leaving this here so someone else doesn't waste an afternoon beating their head against this wall. It turns out that 'list' permissions are handled at the bucket level in GCS and you can't restrict them using a Condition based on object name prefix. If you do, you won't be able to access any resources in the bucket, so you have to setup the Member with unrestricted 'Storage Object Viewer' role and use Conditions with specified object prefix for 'Storage Object Admin' or 'Storage Object Creator' to restrict (over)write access. Not ideal if you are trying to keep the contents of your bucket private.
https://cloud.google.com/storage/docs/access-control/iam
"Since the storage.objects.list permission is granted at the bucket level, you cannot use the resource.name condition attribute to restrict object listing access to a subset of objects in the bucket. Users without storage.objects.list permission at the bucket level can experience degraded functionality for the Console and gsutil."
It looks like this has become possible through IAM Conditions.
You need to set a IAM Condition like:
resource.name.startsWith('projects/_/buckets/[BUCKET_NAME]/objects/[OBJECT_PREFIX]')
This condition can't be used for the permission storage.objects.list though. Add two roles to a group/user. The first one to grant list access to the whole bucket and the second one containing the condition above to allow read/write access to all objects in your "folder". Like this the group/user can list all objects in the bucket, but can only read/download/write the allowed ones.
There are some limitations here, such as no longer being able to use the gsutil acl ch commands referenced in other answers.
You cannot do this in GCS. GCS provides permissions to buckets and permissions to objects. A "folder" is not a GCS concept and does not have any properties or permissions.
Make sure, you have configured your bucket to have Fine-Grained Permission.
gsutil -m acl ch -r -g All:R gs://test/public/another/*
If doesn't work,
3. add yourself as gcs admin, legacy reader/writer permission. (which is irrelevant).
But worked for me.
I tried all suggestions here including providing access with CEL. Then I come across why everyone is not successful in resolving this issue is because GCP does not treat folders as existing.
From https://cloud.google.com/storage/docs/folders:
Cloud Storage operates with a flat namespace, which means that folders don't actually exist within Cloud Storage. If you create an object named folder1/file.txt in the bucket your-bucket, the path to the object is your-bucket/folder1/file.txt, but there is no folder named folder1; instead, the string folder1 is part of the object's name.
It's just a visual representation that provides us a hierarchical feel of the bucket and objects within it.
In the google document, it says:
"The maximum number of ACL entries you can create for a bucket or object is 100"
does that mean I can create just 100 Regardless of objects or buckets? or I can create 100 each objects and bucket?
Any help? Thanks.
All objects and all buckets have an ACL list. Any ACL list may have up to 100 entries, but no more. So a bucket can have 100 entries in its ACL, and an object in that bucket may also have 100 entries in that object's ACL.
Note: it is generally not recommended to place large numbers of ACL entries in an object or bucket's ACL list. Instead, consider one of these alternatives, which both have the advantage of not needing to modify the bucket or object when adding or removing users and groups:
Add the user or groups you need to your project's OWNER, EDITOR, and VIEWER roles, and use those roles in your bucket and object ACLs.
Add the user or groups you need to a google group and then add that google group to your bucket and object ACLs.