apache · dishtikundra · Aug 12, 2026
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/store/EmbeddedServiceDefsUtil.java b/agents-common/src/main/java/org/apache/ranger/plugin/store/EmbeddedServiceDefsUtil.java
@@ -49,7 +49,7 @@ public class EmbeddedServiceDefsUtil {
     private static final Logger LOG = LoggerFactory.getLogger(EmbeddedServiceDefsUtil.class);
 
     // following servicedef list should be reviewed/updated whenever a new embedded service-def is added
-    public static final String DEFAULT_BOOTSTRAP_SERVICEDEF_LIST        = "tag,gds,hdfs,hbase,hive,kms,knox,storm,yarn,kafka,solr,atlas,nifi,nifi-registry,sqoop,kylin,elasticsearch,presto,trino,ozone,kudu,schema-registry,nestedstructure,polaris";
+    public static final String DEFAULT_BOOTSTRAP_SERVICEDEF_LIST        = "tag,gds,hdfs,hbase,hive,kms,knox,storm,yarn,kafka,solr,atlas,nifi,nifi-registry,sqoop,kylin,elasticsearch,presto,trino,ozone,kudu,schema-registry,nestedstructure,polaris,s3";
     public static final String EMBEDDED_SERVICEDEF_TAG_NAME             = "tag";
     public static final String EMBEDDED_SERVICEDEF_GDS_NAME             = "gds";
     public static final String EMBEDDED_SERVICEDEF_HDFS_NAME            = "hdfs";
@@ -76,6 +76,7 @@ public class EmbeddedServiceDefsUtil {
     public static final String EMBEDDED_SERVICEDEF_KUDU_NAME            = "kudu";
     public static final String EMBEDDED_SERVICEDEF_NESTEDSTRUCTURE_NAME = "nestedstructure";
     public static final String EMBEDDED_SERVICEDEF_POLARIS_NAME         = "polaris";
+    public static final String EMBEDDED_SERVICEDEF_S3_NAME              = "s3";
 
     public static final String PROPERTY_CREATE_EMBEDDED_SERVICE_DEFS = "ranger.service.store.create.embedded.service-defs";
     public static final String HDFS_IMPL_CLASS_NAME                  = "org.apache.ranger.services.hdfs.RangerServiceHdfs";
@@ -98,7 +99,7 @@ public class EmbeddedServiceDefsUtil {
     private static final String                  PROPERTY_SUPPORTED_SERVICE_DEFS = "ranger.supportedcomponents";
     private static final EmbeddedServiceDefsUtil instance                        = new EmbeddedServiceDefsUtil();
 
-    private final RangerAdminConfig       config;
+    private final RangerAdminConfig         config;
     private       Set<String>             supportedServiceDefs;
     private       boolean                 createEmbeddedServiceDefs = true;
     private       RangerServiceDef        hdfsServiceDef;
@@ -125,6 +126,7 @@ public class EmbeddedServiceDefsUtil {
     private       RangerServiceDef        kuduServiceDef;
     private       RangerServiceDef        nestedStructureServiveDef;
     private       RangerServiceDef        polarisServiceDef;
+    private       RangerServiceDef        s3ServiceDef;
     private       RangerServiceDef        tagServiceDef;
     private       RangerServiceDef        gdsServiceDef;
 
@@ -189,6 +191,7 @@ public void init(ServiceStore store) {
             kuduServiceDef            = getOrCreateServiceDef(store, EMBEDDED_SERVICEDEF_KUDU_NAME);
             nestedStructureServiveDef = getOrCreateServiceDef(store, EMBEDDED_SERVICEDEF_NESTEDSTRUCTURE_NAME);
             polarisServiceDef         = getOrCreateServiceDef(store, EMBEDDED_SERVICEDEF_POLARIS_NAME);
+            s3ServiceDef              = getOrCreateServiceDef(store, EMBEDDED_SERVICEDEF_S3_NAME);
 
             gdsServiceDef = getOrCreateServiceDef(store, EMBEDDED_SERVICEDEF_GDS_NAME);
 
@@ -296,6 +299,10 @@ public long getPolarisServiceDefId() {
         return getId(polarisServiceDef);
     }
 
+    public long getS3ServiceDefId() {
+        return getId(s3ServiceDef);
+    }
+
     public long getTagServiceDefId() {
         return getId(tagServiceDef);
     }

diff --git a/agents-common/src/main/resources/service-defs/ranger-servicedef-s3.json b/agents-common/src/main/resources/service-defs/ranger-servicedef-s3.json
@@ -0,0 +1,144 @@
+{
+  "id":21,
+  "name": "s3",
+  "displayName": "S3",
+  "implClass": "org.apache.ranger.services.s3.RangerServiceS3",
+  "label": "S3 Repository",
+  "description": "S3 Repository",
+  "guid": "",
+  "resources":
+  [
+    {
+      "itemId": 1,
+      "name": "path",
+      "type": "path",
+      "level": 10,
+      "parent": "",
+      "mandatory": true,
+      "lookupSupported": true,
+      "recursiveSupported": true,
+      "excludesSupported": false,
+      "matcher": "org.apache.ranger.plugin.resourcematcher.RangerPathResourceMatcher",
+      "matcherOptions": { "wildCard":true, "ignoreCase":false },
+      "validationRegEx":"",
+      "validationMessage": "",
+      "uiHint":"",
+      "label": "S3 Bucket/Object Path",
+      "description": "S3 Bucket or object path"
+    }
+  ],
+
+  "accessTypes":
+  [
+    {
+      "itemId": 1,
+      "name": "s3:ListBucket",
+      "label": "ListBucket"
+    },
+
+    {
+      "itemId": 2,
+      "name": "s3:PutObject",
+      "label": "PutObject"
+    },
+
+    {
+      "itemId": 3,
+      "name": "s3:GetObject",
+      "label": "GetObject"
+    },
+
+    {
+      "itemId": 4,
+      "name": "s3:DeleteObject",
+      "label": "DeleteObject"
+    }
+  ],
+
+  "configs":
+  [
+    {
+      "itemId": 1,
+      "name": "username",
+      "type": "string",
+      "subType": "",
+      "mandatory": true,
+      "validationRegEx":"",
+      "validationMessage": "",
+      "uiHint":"",
+      "label": "Username"
+    },
+    {
+      "itemId": 2,
+      "name": "accesskey",
+      "type": "string",
+      "subType": "",
+      "mandatory": true,
+      "validationRegEx":"",
+      "validationMessage": "",
+      "uiHint":"",
+      "label": "Access key"
+    },
+
+    {
+      "itemId": 3,
+      "name": "secretkey",
+      "type": "password",
+      "subType": "",
+      "mandatory": true,
+      "validationRegEx":"",
+      "validationMessage": "",
+      "uiHint":"",
+      "label": "Secret key"
+    },
+
+    {
+      "itemId": 4,
+      "name": "endpoint",
+      "type": "string",
+      "subType": "",
+      "mandatory": true,
+      "validationRegEx":"",
+      "validationMessage": "",
+      "uiHint":"",
+      "label": "End Point URL"
+    },
+    {
+      "itemId": 5,
+      "name": "region",
+      "type": "string",
+      "subType": "",
+      "mandatory": true,
+      "validationRegEx":"",
+      "validationMessage": "",
+      "uiHint":"",
+      "label": "Region"
+    },
+
+    {
+      "itemId": 6,
+      "name": "bucketname",
+      "type": "string",
+      "subType": "",
+      "mandatory": true,
+      "validationRegEx":"",
+      "validationMessage": "",
+      "uiHint":"",
+      "label": "Bucket Name"
+    }
+  ],
+
+  "enums":
+  [
+  ],
+
+  "contextEnrichers":
+  [
+
+  ],
+
+  "policyConditions":
+  [
+
+  ]
+}
diff --git a/distro/pom.xml b/distro/pom.xml
@@ -71,6 +71,13 @@
             <version>${project.version}</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.ranger</groupId>
+            <artifactId>pamCredValidator</artifactId>
+            <version>${project.version}</version>
+            <type>uexe</type>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.apache.ranger</groupId>
             <artifactId>ranger-atlas-plugin</artifactId>

diff --git a/distro/src/main/assembly/admin-web.xml b/distro/src/main/assembly/admin-web.xml
@@ -516,6 +516,26 @@
         </includes>
       </binaries>
     </moduleSet>
+
+    <moduleSet>
+      <useAllReactorProjects>true</useAllReactorProjects>
+      <includes>
+        <include>org.apache.ranger:s3-agent</include>
+      </includes>
+      <binaries>
+        <outputDirectory>ews/webapp/WEB-INF/classes/ranger-plugins/s3</outputDirectory>
+        <includeDependencies>true</includeDependencies>
+        <unpack>false</unpack>
+        <directoryMode>755</directoryMode>
+        <fileMode>644</fileMode>
+        <includes>
+          <include>software.amazon.awssdk:s3</include>
+          <include>software.amazon.awssdk:auth</include>
+          <include>software.amazon.awssdk:regions</include>
+          <include>software.amazon.awssdk:iam</include>
+        </includes>
+      </binaries>
+    </moduleSet>
   </moduleSets>
 
   <fileSets>

diff --git a/pom.xml b/pom.xml
@@ -46,6 +46,7 @@
         <atlas.jettison.version>1.3.7</atlas.jettison.version>
         <atlas.version>2.4.0</atlas.version>
         <aws-java-sdk.version>1.12.765</aws-java-sdk.version>
+        <aws-java-sdk2.version>2.17.102</aws-java-sdk2.version>
         <bouncycastle.version>1.84</bouncycastle.version>
         <cglib.version>2.2.0-b23</cglib.version>
         <checkstyle.failOnViolation>true</checkstyle.failOnViolation>
@@ -970,6 +971,7 @@
                 <module>ranger-tools</module>
                 <module>ranger-util</module>
                 <module>ranger-yarn-plugin-shim</module>
+                <module>s3-agent</module>
                 <module>security-admin</module>
                 <module>storm-agent</module>
                 <module>tagsync</module>
@@ -995,6 +997,7 @@
             <modules>
                 <module>agents-common</module>
                 <module>common-utils</module>
+                <module>s3-agent</module>
                 <module>security-admin</module>
                 <module>ugsync-util</module>
             </modules>
@@ -1321,6 +1324,7 @@
                 <module>ranger-tools</module>
                 <module>ranger-util</module>
                 <module>ranger-yarn-plugin-shim</module>
+                <module>s3-agent</module>
                 <module>security-admin</module>
                 <module>storm-agent</module>
                 <module>tagsync</module>
@@ -1409,6 +1413,7 @@
                 <module>ranger-tools</module>
                 <module>ranger-util</module>
                 <module>ranger-yarn-plugin-shim</module>
+                <module>s3-agent</module>
                 <module>security-admin</module>
                 <module>storm-agent</module>
                 <module>tagsync</module>

diff --git a/s3-agent/pom.xml b/s3-agent/pom.xml
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.apache.ranger</groupId>
+        <artifactId>ranger</artifactId>
+        <version>3.0.0-SNAPSHOT</version>
+        <relativePath>..</relativePath>
+    </parent>
+    <artifactId>s3-agent</artifactId>
+    <packaging>jar</packaging>
+    <name>S3 Policies Agent</name>
+    <description>S3 Policies Agent</description>
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    </properties>
+    <dependencies>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>${fasterxml.jackson.databind.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.ranger</groupId>
+            <artifactId>ranger-plugins-common</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>auth</artifactId>
+            <version>${aws-java-sdk2.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>iam</artifactId>
+            <version>${aws-java-sdk2.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>regions</artifactId>
+            <version>${aws-java-sdk2.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>software.amazon.awssdk</groupId>
+            <artifactId>s3</artifactId>
+            <version>${aws-java-sdk2.version}</version>
+        </dependency>
+
+    </dependencies>
+</project>
diff --git a/s3-agent/src/main/java/org/apache/ranger/services/s3/RangerS3Constants.java b/s3-agent/src/main/java/org/apache/ranger/services/s3/RangerS3Constants.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ranger.services.s3;
+
+public class RangerS3Constants {
+    public static final String S3 = "s3";
+    public static final String AWS = "AWS";
+    public static final String ALLOW = "Allow";
+    public static final String DENY = "Deny";
+    public static final String S3_POLICY_LANGUAGE_VERSION = "2012-10-17";
+    public static final String USER_NAME = "username";
+    public static final String ACCESS_KEY = "accesskey";
+    public static final String SECRET_KEY = "secretkey";
+    public static final String ENDPOINT = "endpoint";
+    public static final String REGION = "region";
+    public static final String BUCKET_NAME = "bucketname";
+    public static final String PATH = "path";
+    public static final String S3_RESOURCE_PATH_ARN = "arn:aws:s3:::";
+    public static final String S3_AWS_ACCOUNT_URN = "arn:aws:iam::";
+    public static final int MAX_AUTOCOMPLETE_RESULTS = 100;
+    public static final int S3_LIST_OBJECTS_MAX_KEYS = 500;
+
+    private RangerS3Constants() {
+    }
+}