使用s3cmd无法批量删除Ceph存储桶文件的问题排查

问题现象 #

使用s3cmd递归删除Ceph存储桶文件时触发403权限拒绝错误：

s3cmd rm --recursive --force s3://search-backup/
ERROR: S3 error: 403 (AccessDenied)

但单个文件删除命令可正常执行：

s3cmd rm s3://search-backup/tests-12-4O9i-QSKbAnNQARHCnA/data-gXYONdsDQ1-87v5vOqsL2g.dat
delete: 's3://search-backup/tests-12-4O9i-QSKbAnNQARHCnA/data-gXYONdsDQ1-87v5vOqsL2g.dat'

替换为del命令执行批量删除也会出现相同错误。

权限策略问题分析 #

查看提供的存储桶权限策略，存在两个关键问题：

• JSON语法错误：第一个Statement的Action数组中，"s3:PutBucketObjectLockConfiguration"后缺少逗号，导致后续的"s3:ListBucket"无法被正确解析；且ListBucket属于桶级权限，本就不应放在对象级资源（arn:aws:s3:::search-backup/*）的Statement中。
• 桶级权限放置错误："s3:PutBucketObjectLockConfiguration"是桶级操作权限，必须绑定桶资源（arn:aws:s3:::search-backup），但当前被错误放在对象级资源的Statement中，无法生效。

修正后的权限策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam:::user/search_backup"
                ]
            },
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionTagging",
                "s3:GetObjectRetention",
                "s3:GetObjectLegalHold",
                "s3:GetObjectTagging",
                "s3:PutObject",
                "s3:PutObjectRetention",
                "s3:PutObjectAcl",
                "s3:PutObjectLegalHold",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:DeleteObjectTagging",
                "s3:PutObjectTagging",
                "s3:RestoreObject"
            ],
            "Resource": [
                "arn:aws:s3:::search-backup/*"
            ]
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam:::user/search_backup"
                ]
            },
            "Action": [
                "s3:GetBucketAcl",
                "s3:GetBucketCORS",
                "s3:GetBucketLocation",
                "s3:GetBucketNotification",
                "s3:PutBucketNotification",
                "s3:GetBucketObjectLockConfiguration",
                "s3:PutBucketObjectLockConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetBucketVersioning",
                "s3:ListBucketVersions",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:GetLifecycleConfiguration",
                "s3:GetReplicationConfiguration",
                "s3:ListAllMyBuckets",
                "s3:GetBucketTagging",
                "s3:PutBucketTagging",
                "s3:PutBucketCORS"
            ],
            "Resource": [
                "arn:aws:s3:::search-backup"
            ]
        }
    ]
}

后续操作建议 #

1. 将修正后的策略重新应用到存储桶。
2. 测试批量删除命令，确认是否恢复正常。
3. 若仍报错，使用s3cmd --debug rm --recursive --force s3://search-backup/开启调试模式，查看具体是哪个请求返回403，进一步定位权限问题。

内容的提问来源于stack exchange，提问作者CJW