Github-Mirror/seaweedfs
1
0 Fork 0
mirror of https://github.com/seaweedfs/seaweedfs.git synced 2026-11-07 20:47:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

s3api: evaluate object-tag policy conditions on delete, ACL and lock operations (#11807)

Browse Source 
* s3api: resolve the target version in tag-condition policy lookups

* s3api: apply tag-conditioned policy to object deletes

* s3api: apply tag-conditioned policy to object ACL reads and writes

* s3api: apply tag-conditioned policy to retention and legal hold

* s3api: cover tag-conditioned delete, ACL and object-lock rechecks

* s3api: let tag-conditioned grants redecide denied batch deletes

* s3api: resolve the tagged version in delete policy tests
This commit is contained in:
Chris Lu authored and GitHub committed 2026-10-17 22:30:32 -07:00
1 parent 2ff7888546
commit e596be10f0
8 files changed
+267 -13
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

weed/s3api/policy_engine/README_POLICY_ENGINE.md
+7 -3
View File
@@ -193,9 +193,13 @@ This allows anonymous access only to objects that have a tag `status=public`.
**Supported Operations for Tag-Based Conditions:**
Tag-based conditions (`s3:ExistingObjectTag/<key>`) are evaluated for the following operations:
- `s3:GetObject` (GET object)
- `s3:GetObjectVersion` (GET object with versionId)
- `s3:HeadObject` (HEAD object)
- `s3:GetObject` / `s3:GetObjectVersion` / `s3:HeadObject` (object reads, including the source of CopyObject, UploadPartCopy and RenameObject)
- `s3:DeleteObject` / `s3:DeleteObjectVersion` (single and batch deletes)
- `s3:GetObjectAcl` / `s3:PutObjectAcl`
- `s3:GetObjectTagging` / `s3:PutObjectTagging` / `s3:DeleteObjectTagging`
- `s3:GetObjectAttributes`
- `s3:GetObjectRetention` / `s3:PutObjectRetention`
- `s3:GetObjectLegalHold` / `s3:PutObjectLegalHold`
Note: For these conditions to be evaluated, the object must exist and the policy engine re-checks access after fetching the object metadata.