Github-Mirror/seaweedfs
1
0 Fork 0
mirror of https://github.com/seaweedfs/seaweedfs.git synced 2026-10-13 17:48:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Document multipart upload permission inheritance in S3 policies 

Added new section 'Multipart Upload Permission Inheritance' explaining how
granting s3:PutObject implicitly allows all multipart upload operations
(CreateMultipartUpload, UploadPart, CompleteMultipartUpload,
AbortMultipartUpload, ListBucketMultipartUploads, ListMultipartUploadParts).

This aligns with AWS S3 semantics where multipart upload is an implementation
detail of s3:PutObject.
Chris Lu committed 2026-02-25 13:38:33 -08:00
1 parent 50f0754269
commit 1d4070befe
1 file changed
+16 -1
Download Patch File Download Diff File Expand all files Collapse all files
S3-Bucket-Policies.md
+16 -1
@@ -246,10 +246,25 @@ Common actions in bucket policies:
- **Object Operations**: `s3:GetObject`, `s3:PutObject`, `s3:DeleteObject`
- **Bucket Operations**: `s3:ListBucket`, `s3:CreateBucket`, `s3:DeleteBucket`
- **ACL Operations**: `s3:PutObjectAcl`, `s3:GetObjectAcl`
- **Multipart Operations**: `s3:CreateMultipartUpload`, `s3:UploadPart`, `s3:CompleteMultipartUpload`
- **Multipart Operations**: `s3:CreateMultipartUpload`, `s3:UploadPart`, `s3:CompleteMultipartUpload`, `s3:AbortMultipartUpload`, `s3:ListBucketMultipartUploads`, `s3:ListMultipartUploadParts`
- **Object Tagging**: `s3:GetObjectTagging`, `s3:PutObjectTagging`
- **Versioning**: `s3:GetObjectVersion`, `s3:PutObjectVersionAcl`
## Multipart Upload Permission Inheritance
When a policy grants `s3:PutObject`, it implicitly allows all multipart upload operations:
- `s3:CreateMultipartUpload` - Start a multipart upload
- `s3:UploadPart` - Upload parts of a multipart upload
- `s3:CompleteMultipartUpload` - Complete a multipart upload
- `s3:AbortMultipartUpload` - Abort an incomplete multipart upload
- `s3:ListBucketMultipartUploads` - List in-progress multipart uploads
- `s3:ListMultipartUploadParts` - List parts of a multipart upload
This behavior aligns with AWS S3 semantics where multipart upload is considered an implementation detail of `s3:PutObject`. Users can upload large objects using either a single direct upload (if `s3:PutObject` is granted) or multiple parts via multipart upload (also allowed by `s3:PutObject`).
**Example**: A policy granting only `s3:PutObject` is sufficient to perform complete multipart uploads without explicitly listing all multipart actions.
## Policy Validation
SeaweedFS validates bucket policies for: