avoid hack

weed/s3api/auth_credentials.go

@@ -652,11 +652,6 @@ func (iam *IdentityAccessManagement) authorizeWithIAM(r *http.Request, identity
 		Account:      identity.Account,
 	}
 
-	// Defensive deny for write-only roles performing read/list actions
-	if strings.Contains(principal, "WriteOnlyRole") && (action == s3_constants.ACTION_READ || action == s3_constants.ACTION_LIST) {
-		return s3err.ErrAccessDenied
-	}
-
 	// Use IAM integration for authorization
 	return iam.iamIntegration.AuthorizeAction(ctx, iamIdentity, action, bucket, object, r)
 }

weed/s3api/s3_iam_middleware.go

@@ -155,12 +155,6 @@ func (s3iam *S3IAMIntegration) AuthorizeAction(ctx context.Context, identity *IA
 		return s3err.ErrAccessDenied
 	}
 
-	// Special handling for write-only roles to enforce read restrictions
-	// This is a workaround for IAM policy evaluation issues with explicit deny statements
-	if strings.Contains(identity.Principal, "WriteOnlyRole") && (action == s3_constants.ACTION_READ || action == s3_constants.ACTION_LIST) {
-		return s3err.ErrAccessDenied
-	}
-
 	// Build resource ARN for the S3 operation
 	resourceArn := buildS3ResourceArn(bucket, objectKey)