s3tables: reject s3vectors resources in bucket policies (#12213)

An arn:aws:s3vectors: Resource is as dead as an s3vectors action: the
evaluator compares against the generated s3tables ARN, so the rule the
writer believes enforced never matches.

weed/s3api/s3tables/permissions.go

@@ -142,9 +142,9 @@ func CheckTableOrBucketPermission(operation, principal, resourceOwner, resourceP
 }
 
 // validatePolicyDocument rejects a policy the evaluator could not honor: one
-// that does not parse, or whose actions live in a namespace that never
-// matches. An s3vectors action stored here would be a dead rule the writer
-// believes is enforced — vector requests authorize their s3tables action.
+// that does not parse, or whose actions and resources name the vector service.
+// Either stored here would be a dead rule the writer believes is enforced —
+// vector requests authorize their s3tables action on a s3tables ARN.
 func validatePolicyDocument(raw string) error {
 	var doc PolicyDocument
 	if err := json.Unmarshal([]byte(raw), &doc); err != nil {
@@ -156,6 +156,11 @@ func validatePolicyDocument(raw string) error {
 				return fmt.Errorf("action %q is not enforceable in a resource policy", action)
 			}
 		}
+		for _, resource := range statementActions(stmt.Resource) {
+			if strings.HasPrefix(resource, "arn:aws:s3vectors:") {
+				return fmt.Errorf("resource %q is not enforceable in a resource policy", resource)
+			}
+		}
 	}
 	return nil
 }

weed/s3api/s3tables/permissions_test.go

@@ -445,4 +445,8 @@ func TestValidatePolicyDocument(t *testing.T) {
 	if err := validatePolicyDocument(deadList); err == nil {
 		t.Fatal("action list containing s3vectors should be rejected")
 	}
+	deadResource := `{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":"*","Action":"s3tables:*","Resource":"arn:aws:s3vectors:r:a:bucket/b"}]}`
+	if err := validatePolicyDocument(deadResource); err == nil {
+		t.Fatal("s3vectors resource should be rejected")
+	}
 }