A.16. 역할을 조작하기 위한 REST API
radosgw-admin 역할 명령 외에도 REST API를 사용하여 역할을 조작할 수 있습니다.
REST 관리 API를 호출하려면 admin caps가 있는 사용자를 생성합니다.
예제
[root@host01 ~]# radosgw-admin --uid TESTER --display-name "TestUser" --access_key TESTER --secret test123 user create [root@host01 ~]# radosgw-admin caps add --uid="TESTER" --caps="roles=*"
역할을 생성합니다.
구문
POST “<hostname>?Action=CreateRole&RoleName=ROLE_NAME&Path=PATH_TO_FILE&AssumeRolePolicyDocument=TRUST_RELATIONSHIP_POLICY_DOCUMENT”
예제
POST “<hostname>?Action=CreateRole&RoleName=S3Access&Path=/application_abc/component_xyz/&AssumeRolePolicyDocument={"Version":"2022-06-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["arn:aws:iam:::user/TESTER"]},"Action":["sts:AssumeRole"]}]}”응답 예
<role> <id>8f41f4e0-7094-4dc0-ac20-074a881ccbc5</id> <name>S3Access</name> <path>/application_abc/component_xyz/</path> <arn>arn:aws:iam:::role/application_abc/component_xyz/S3Access</arn> <create_date>2022-06-23T07:43:42.811Z</create_date> <max_session_duration>3600</max_session_duration> <assume_role_policy_document>{"Version":"2022-06-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["arn:aws:iam:::user/TESTER"]},"Action":["sts:AssumeRole"]}]}</assume_role_policy_document> </role>역할을 가져옵니다.
구문
POST “<hostname>?Action=GetRole&RoleName=ROLE_NAME”예제
POST “<hostname>?Action=GetRole&RoleName=S3Access”
응답 예
<role> <id>8f41f4e0-7094-4dc0-ac20-074a881ccbc5</id> <name>S3Access</name> <path>/application_abc/component_xyz/</path> <arn>arn:aws:iam:::role/application_abc/component_xyz/S3Access</arn> <create_date>2022-06-23T07:43:42.811Z</create_date> <max_session_duration>3600</max_session_duration> <assume_role_policy_document>{"Version":"2022-06-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["arn:aws:iam:::user/TESTER"]},"Action":["sts:AssumeRole"]}]}</assume_role_policy_document> </role>역할을 나열합니다.
구문
POST “<hostname>?Action=GetRole&RoleName=ROLE_NAME&PathPrefix=PATH_PREFIX”
요청 예
POST “<hostname>?Action=ListRoles&RoleName=S3Access&PathPrefix=/application”
응답 예
<role> <id>8f41f4e0-7094-4dc0-ac20-074a881ccbc5</id> <name>S3Access</name> <path>/application_abc/component_xyz/</path> <arn>arn:aws:iam:::role/application_abc/component_xyz/S3Access</arn> <create_date>2022-06-23T07:43:42.811Z</create_date> <max_session_duration>3600</max_session_duration> <assume_role_policy_document>{"Version":"2022-06-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["arn:aws:iam:::user/TESTER"]},"Action":["sts:AssumeRole"]}]}</assume_role_policy_document> </role>assume 역할 정책 문서를 업데이트합니다.
구문
POST “<hostname>?Action=UpdateAssumeRolePolicy&RoleName=ROLE_NAME&PolicyDocument=TRUST_RELATIONSHIP_POLICY_DOCUMENT”
예제
POST “<hostname>?Action=UpdateAssumeRolePolicy&RoleName=S3Access&PolicyDocument={"Version":"2022-06-17","Statement":[{"Effect":"Allow","Principal":{"AWS":["arn:aws:iam:::user/TESTER2"]},"Action":["sts:AssumeRole"]}]}”역할에 연결된 정책을 업데이트합니다.
구문
POST “<hostname>?Action=PutRolePolicy&RoleName=ROLE_NAME&PolicyName=POLICY_NAME&PolicyDocument=TRUST_RELATIONSHIP_POLICY_DOCUMENT”
예제
POST “<hostname>?Action=PutRolePolicy&RoleName=S3Access&PolicyName=Policy1&PolicyDocument={"Version":"2022-06-17","Statement":[{"Effect":"Allow","Action":["s3:CreateBucket"],"Resource":"arn:aws:s3:::example_bucket"}]}”역할에 연결된 권한 정책 이름을 나열합니다.
구문
POST “<hostname>?Action=ListRolePolicies&RoleName=ROLE_NAME”예제
POST “<hostname>?Action=ListRolePolicies&RoleName=S3Access” <PolicyNames> <member>Policy1</member> </PolicyNames>
역할에 연결된 권한 정책을 가져옵니다.
구문
POST “<hostname>?Action=GetRolePolicy&RoleName=ROLE_NAME&PolicyName=POLICY_NAME”
예제
POST “<hostname>?Action=GetRolePolicy&RoleName=S3Access&PolicyName=Policy1” <GetRolePolicyResult> <PolicyName>Policy1</PolicyName> <RoleName>S3Access</RoleName> <Permission_policy>{"Version":"2022-06-17","Statement":[{"Effect":"Allow","Action":["s3:CreateBucket"],"Resource":"arn:aws:s3:::example_bucket"}]}</Permission_policy> </GetRolePolicyResult>역할에 연결된 정책 삭제:
구문
POST “hostname>?Action=DeleteRolePolicy&RoleName=ROLE_NAME&PolicyName=POLICY_NAME“
예제
POST “<hostname>?Action=DeleteRolePolicy&RoleName=S3Access&PolicyName=Policy1”
역할을 삭제합니다.
참고권한 정책이 연결되어 있지 않은 경우에만 역할을 삭제할 수 있습니다.
구문
POST “<hostname>?Action=DeleteRole&RoleName=ROLE_NAME"예제
POST “<hostname>?Action=DeleteRole&RoleName=S3Access"
추가 리소스
- 자세한 내용은 Red Hat Ceph Storage Object Gateway 가이드 의 역할 관리 섹션을 참조하십시오.
