S3 object ownership

[klizhentas]

Consider two accounts Tenant and Audit. Account Audit owns S3 bucket Logs. Account Tenant has a write permission to the bucket Logs. The problem is that when Tenant creates an S3 object it is logged as an object owner unless it transfers ownership.

If Tenant is then deleted, Audit will loose access to the bucket. Ownership can be relinquished using simple setting of ACL;

Clarify:

• It seems that there is a global setting "bucket owner preferred" that achieves just that

https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html#enable-object-ownership
https://www.amazonaws.cn/en/new/2020/amazon-s3-object-ownership-enables-bucket-owners-to-automatically-assume-ownership-of-objects-uploaded-to-their-buckets/

[atburke]

I'm thinking that the user workflow should look something like this:

• Bucket owner sets Object Ownership to "Bucket owner preferred".
• Teleport sends bucket-owner-full-control ACL when uploading audit logs. We can add a new boolean var to teleport.yaml to signal when to do this (I'm currently also calling it bucket_owner_full_control). This is enough to transfer ownership.
• To enforce the transfer, include this in the bucket policy:

{
    "Version": "2012-10-17",
    "Id": "[id]",
    "Statement": [
        {
            "Sid": "[sid]",
            "Effect": "Allow",
            "Principal": {
                "AWS": "[arn of Tenant]"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::Logs/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control"
                }
            }
        }
    ]
}

[russjones]

@stevenGravy Can you take a look?