Prefer IAM path when policies exist

weed/s3api/s3tables/handler_bucket_create.go

@@ -28,11 +28,12 @@ func (h *S3TablesHandler) handleCreateTableBucket(w http.ResponseWriter, r *http
 
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
-	if h.shouldUseIAM(r, identityActions) && !h.defaultAllow {
+	identityPolicyNames := getIdentityPolicyNames(r)
+	if h.shouldUseIAM(r, identityActions, identityPolicyNames) && !h.defaultAllow {
 		ownerAccountID := h.getAccountID(r)
 		tableBucketARN := h.generateTableBucketARN(ownerAccountID, req.Name)
 		s3BucketARN := fmt.Sprintf("arn:aws:s3:::%s", req.Name)
-		allowed, err := h.authorizeIAMAction(r, "s3tables:CreateTableBucket", tableBucketARN, s3BucketARN)
+		allowed, err := h.authorizeIAMAction(r, identityPolicyNames, "s3tables:CreateTableBucket", tableBucketARN, s3BucketARN)
 		if err != nil || !allowed {
 			h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to create table buckets")
 			return NewAuthError("CreateTableBucket", principal, "not authorized to create table buckets")

weed/s3api/s3tables/iam.go

@@ -22,14 +22,17 @@ func (h *S3TablesHandler) SetIAMAuthorizer(authorizer IAMAuthorizer) {
 	h.iamAuthorizer = authorizer
 }
 
-func (h *S3TablesHandler) shouldUseIAM(r *http.Request, identityActions []string) bool {
+func (h *S3TablesHandler) shouldUseIAM(r *http.Request, identityActions, identityPolicyNames []string) bool {
 	if h.iamAuthorizer == nil || r == nil {
 		return false
 	}
 	if hasSessionToken(r) {
 		return true
 	}
-	return len(identityActions) == 0
+	if len(identityActions) == 0 {
+		return true
+	}
+	return len(identityPolicyNames) > 0
 }
 
 func hasSessionToken(r *http.Request) bool {
@@ -42,7 +45,7 @@ func hasSessionToken(r *http.Request) bool {
 	return r.URL.Query().Get("X-Amz-Security-Token") != ""
 }
 
-func (h *S3TablesHandler) authorizeIAMAction(r *http.Request, action string, resources ...string) (bool, error) {
+func (h *S3TablesHandler) authorizeIAMAction(r *http.Request, identityPolicyNames []string, action string, resources ...string) (bool, error) {
 	if h.iamAuthorizer == nil {
 		return false, nil
 	}
@@ -67,7 +70,10 @@ func (h *S3TablesHandler) authorizeIAMAction(r *http.Request, action string, res
 	}
 
 	requestContext := buildIAMRequestContext(r, getIdentityClaims(r))
-	policyNames := getIdentityPolicyNames(r)
+	policyNames := identityPolicyNames
+	if len(policyNames) == 0 {
+		policyNames = getIdentityPolicyNames(r)
+	}
 
 	var lastErr error
 	for _, resource := range resources {