astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-11-01 05:12:07 +03:00
Code Issues Packages Projects Releases Wiki Activity

test: verify least-privilege delete replication

Browse Source 
Document that replication targets retain the DeleteObject plus ReplicateDelete contract and extend the existing two-site test with a target user that lacks DeleteObjectVersion. Use mc for explicit version deletion so the gate no longer depends on AWS CLI.

Signed-off-by: Feng Ruohang <rh@vonng.com>
This commit is contained in:
Feng Ruohang
2026-09-02 01:48:55 +08:00
parent 75a6734e49
commit c4140609b7
2 changed files with 82 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/bucket/replication/README.md
+10
View File
@@ -96,6 +96,12 @@ The access key provided for the replication *target* cluster should have these m
Please note that the permissions required by the admin user on the target cluster can be more fine grained to exclude permissions like "s3:ReplicateDelete", "s3:GetBucketObjectLockConfiguration" etc depending on whether delete replication rules are set up or if object locking is disabled on `destbucket`. The above policies assume that replication of objects, tags and delete marker replication are all enabled on object lock enabled buckets. A sample script to setup replication is provided [here](https://github.com/pgsty/silo/blob/main/docs/bucket/replication/setup_replication.sh)
The target replication credential continues to authorize replicated deletes with
`s3:DeleteObject` plus `s3:ReplicateDelete`; it does not need
`s3:DeleteObjectVersion`. This internal receiver contract is deliberately
separate from ordinary S3 requests: a client deleting an explicitly named
version, including `versionId=null`, must have `s3:DeleteObjectVersion`.
To set up replication from `srcbucket` on the `mysilo` cluster to `destbucket`
on a target Silo cluster at `https://replica-endpoint:9000`, use:
```
@@ -200,6 +206,10 @@ To add a replication rule allowing both delete marker replication, versioned del
Additional permission of "s3:ReplicateDelete" action would need to be specified on the access key configured for the target cluster if Delete Marker replication or versioned delete replication is enabled.
An explicit deny on `s3:DeleteObjectVersion` still blocks the corresponding
replicated version purge. An allow is not otherwise required for the target
replication credential.
```
mc replicate add mysilo/srcbucket/Tax --priority 1 --remote-bucket `remote-target` --tags "Year=2019&Company=AcmeCorp" --storage-class "STANDARD" --replicate "delete,delete-marker"
Replication configuration applied successfully to mysilo/srcbucket.