Attempts to use the mc command to configure the minio server with a special user limited:limited123 which does not have permission to create buckets. This mirrors some real life S3 configurations where users are given strict permissions. Arrow S3 operations should still work i
(s3_server, policy, username, password)
| 374 | |
| 375 | |
| 376 | def _configure_s3_limited_user(s3_server, policy, username, password): |
| 377 | """ |
| 378 | Attempts to use the mc command to configure the minio server |
| 379 | with a special user limited:limited123 which does not have |
| 380 | permission to create buckets. This mirrors some real life S3 |
| 381 | configurations where users are given strict permissions. |
| 382 | |
| 383 | Arrow S3 operations should still work in such a configuration |
| 384 | (e.g. see ARROW-13685) |
| 385 | """ |
| 386 | |
| 387 | if sys.platform == 'win32': |
| 388 | # Can't rely on FileNotFound check because |
| 389 | # there is sometimes an mc command on Windows |
| 390 | # which is unrelated to the minio mc |
| 391 | pytest.skip('The mc command is not installed on Windows') |
| 392 | |
| 393 | try: |
| 394 | # ensuring version of mc and minio for the capabilities we need |
| 395 | _ensure_minio_component_version('mc', 2021) |
| 396 | _ensure_minio_component_version('minio', 2021) |
| 397 | |
| 398 | tempdir = s3_server['tempdir'] |
| 399 | host, port, access_key, secret_key = s3_server['connection'] |
| 400 | address = f'{host}:{port}' |
| 401 | |
| 402 | mcdir = os.path.join(tempdir, 'mc') |
| 403 | if os.path.exists(mcdir): |
| 404 | shutil.rmtree(mcdir) |
| 405 | os.mkdir(mcdir) |
| 406 | policy_path = os.path.join(tempdir, 'limited-buckets-policy.json') |
| 407 | with open(policy_path, mode='w') as policy_file: |
| 408 | policy_file.write(policy) |
| 409 | # The s3_server fixture starts the minio process but |
| 410 | # it takes a few moments for the process to become available |
| 411 | _wait_for_minio_startup(mcdir, address, access_key, secret_key) |
| 412 | # Create a limited user with a specific policy ... |
| 413 | _run_mc_command(mcdir, 'admin', 'user', 'add', |
| 414 | 'myminio/', username, password) |
| 415 | _run_mc_command(mcdir, 'admin', 'policy', 'create', |
| 416 | 'myminio/', 'no-create-buckets', policy_path) |
| 417 | _run_mc_command(mcdir, 'admin', 'policy', 'attach', |
| 418 | 'myminio/', 'no-create-buckets', '--user', username) |
| 419 | # ... and a sample bucket for that user to write to |
| 420 | _run_mc_command(mcdir, 'mb', 'myminio/existing-bucket', |
| 421 | '--ignore-existing') |
| 422 | # Create a protected bucket for testing no-delete-bucket policy |
| 423 | _run_mc_command(mcdir, 'mb', 'myminio/no-delete-bucket', |
| 424 | '--ignore-existing') |
| 425 | |
| 426 | except FileNotFoundError: |
| 427 | pytest.skip("Configuring limited s3 user failed") |
| 428 | |
| 429 | |
| 430 | def running_on_musllinux(): |