From: ShreeJejurikar <shreemj8@gmail.com>
Date: Wed, 13 May 2026 13:05:39 +0000 (+0530)
Subject: rgw/logging: use assumed-role ARN as Requester for STS requests
X-Git-Tag: v21.0.1~153^2~1
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=1854995dce35f4ca945dab0f7cc4a6225f32ef17;p=ceph.git

rgw/logging: use assumed-role ARN as Requester for STS requests

When a request is made with STS temporary credentials, the bucket logging
Requester field was being set to the underlying user ID instead of the
assumed-role ARN. Per the AWS S3 server-access-log spec, the Requester
field should contain the assumed-role ARN (e.g.
arn:aws:sts::<account>:assumed-role/<role>/<session>) for STS-credentialed
requests.

Detect TYPE_ROLE identities via s->auth.identity->get_identity_type() and
use the ARN returned by Identity::get_caller_identity() (already
implemented by RoleApplier in the expected AWS format) instead of falling
straight through to s->user->get_id(). Existing behavior for account- and
user-scoped requests is unchanged.

Fixes: https://tracker.ceph.com/issues/71742
Signed-off-by: Shree Jejurikar <shree.jejurikar@gmail.com>
---

diff --git a/src/rgw/rgw_bucket_logging.cc b/src/rgw/rgw_bucket_logging.cc
index 5d29e17ce21..c7f46605876 100644
--- a/src/rgw/rgw_bucket_logging.cc
+++ b/src/rgw/rgw_bucket_logging.cc
@@ -550,9 +550,19 @@ int log_record(rgw::sal::Driver* driver,
   const auto tt = ceph::coarse_real_time::clock::to_time_t(s->time);
   std::tm t{};
   localtime_r(&tt, &t);
-  auto user_or_account = s->account_name;
+  // AWS S3 spec: log the assumed-role ARN for STS-credentialed requests.
+  std::string user_or_account;
+  if (s->auth.identity && s->auth.identity->get_identity_type() == TYPE_ROLE) {
+    if (auto caller_arn = s->auth.identity->get_caller_identity(); caller_arn) {
+      user_or_account = caller_arn->to_string();
+    }
+  }
   if (user_or_account.empty()) {
-    s->user->get_id().to_str(user_or_account);
+    if (s->account_name.empty()) {
+      s->user->get_id().to_str(user_or_account);
+    } else {
+      user_or_account = s->account_name;
+    }
   }
   auto fqdn = s->info.host;
   if (!s->info.domain.empty() && !fqdn.empty()) {