Shared buckets with prefix based permissions

[wildintellect]

In order to support many research groups we implemented a feature to have group based shared buckets.
In refining this there's been a request to have different permissions per prefix.

I'm not sure it's working as intended in early tests.

My permissions returned by the API

    {
      "access": "read_write",
      "bucket": "jpl-dev-team-test",
      "prefix": "data/",
      "type": "org",
      "uri": "s3://jpl-dev-team-test/data/"
    },
    {
      "access": "read_only",
      "bucket": "jpl-dev-team-test",
      "prefix": "platform/",
      "type": "org",
      "uri": "s3://jpl-dev-team-test/platform/"
    }

However, I can write to neither of these after I removed myself from a 3rd group that had full permissions over the whole bucket.

[wildintellect]

I should clarify that I only tested via the my-team-buckets, will test with direct key access today to verify if it's permissions or just mount errors.

[wildintellect]

(notebook) jovyan@jupyter-alexdevseed--pangeo:~$ aws s3 --profile=geotrees ls s3://jpl-dev-team-test/data/

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: User: arn:aws:sts::**:assumed-role/MAAP-API-User-Folder/workspace-session-alexdevseed is not authorized to perform: s3:ListBucket on resource: "arn:aws:s3:::jpl-dev-team-test" because no session policy allows the s3:ListBucket action
(notebook) jovyan@jupyter-alexdevseed--pangeo:~$ aws s3 --profile=geotrees ls s3://jpl-dev-team-test/platform/

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: User: arn:aws:sts::**:assumed-role/MAAP-API-User-Folder/workspace-session-alexdevseed is not authorized to perform: s3:ListBucket on resource: "arn:aws:s3:::jpl-dev-team-test" because no session policy allows the s3:ListBucket action

Something seems off. Works fine for the geotrees bucket.

[wildintellect]

Sharing one use case we've been discussing with GeoTREES

• 1 shared "public" folder the whole org can Read, limited users can read-write (geotrees team)
• Site specific folders (~20 currently) - owners have read-write, guests are read-only

This will result in potentially ~22 different shares, 11 x2 access rights. No user will be able to see or edit everything.
We propose prefixes in the same bucket for these.

Looking for feedback on the proposal , lead author is @samuelgrubinger

cc: @bsatoriu @sujen1412