]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph.git/commit
rgw/logging: use assumed-role ARN as Requester for STS requests
authorShreeJejurikar <shreemj8@gmail.com>
Wed, 13 May 2026 13:05:39 +0000 (18:35 +0530)
committerShreeJejurikar <shreemj8@gmail.com>
Thu, 21 May 2026 06:32:39 +0000 (12:02 +0530)
commit1854995dce35f4ca945dab0f7cc4a6225f32ef17
tree1a1fd7996802e062a5440f4b8e4086211976bea9
parentfefad99380e9cb4c9be50ee071d8e659f46704de
rgw/logging: use assumed-role ARN as Requester for STS requests

When a request is made with STS temporary credentials, the bucket logging
Requester field was being set to the underlying user ID instead of the
assumed-role ARN. Per the AWS S3 server-access-log spec, the Requester
field should contain the assumed-role ARN (e.g.
arn:aws:sts::<account>:assumed-role/<role>/<session>) for STS-credentialed
requests.

Detect TYPE_ROLE identities via s->auth.identity->get_identity_type() and
use the ARN returned by Identity::get_caller_identity() (already
implemented by RoleApplier in the expected AWS format) instead of falling
straight through to s->user->get_id(). Existing behavior for account- and
user-scoped requests is unchanged.

Fixes: https://tracker.ceph.com/issues/71742
Signed-off-by: Shree Jejurikar <shree.jejurikar@gmail.com>
src/rgw/rgw_bucket_logging.cc