iam: targeted writes for single-user IAM actions (#11877)

* s3api: persist single-identity IAM changes through the credential manager

CreateAccessKey, DeleteAccessKey, UpdateAccessKey, PutUserPolicy, DeleteUserPolicy, SetUserStatus, UpdateUser and DeleteUser used to load the whole configuration, change one identity and then SaveConfiguration, rewriting and re-propagating every identity. They now write only the identity (and, for rename/delete, the groups and service accounts that referenced it) through the credential manager, which propagates that identity alone. Static identities and skipPersist keep the previous full-save/no-write contract.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* iamapi: persist single-identity IAM changes through the credential manager

Same targeted-write change as the embedded IAM API for the standalone weed iam dispatcher: UpdateUser, DeleteUser, CreateAccessKey, DeleteAccessKey, UpdateAccessKey, PutUserPolicy and DeleteUserPolicy write one identity through the credential manager instead of saving the whole configuration. CreateAccessKey keeps the full save when the handler created a user the store does not know.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* credential/memory: re-key identity on UpdateUser rename

UpdateUser stored the identity under the old username key even when identity.Name changed. Re-key it the way filer_etc does (delete old, save new) so the targeted rename path sees the moved record.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* test: cover targeted single-identity IAM writes

Recording-store tests assert each rerouted action uses the single-identity credential store methods and never SaveConfiguration, in both the embedded S3 IAM dispatcher and the standalone iamapi dispatcher, plus the skipPersist and static-identity contracts and a memory-store rename case.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* credential: keep not-found and rename-collision semantics in stores

IamGrpcStore.DeleteAccessKey translates gRPC NotFound to ErrAccessKeyNotFound so a repeat delete stays the no-op the IAM handlers advertise. MemoryStore.UpdateUser rejects a rename onto an existing user instead of overwriting it, matching RenameUser.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

weed/iamapi/iamapi_management_handlers.go

@@ -4,6 +4,7 @@ package iamapi
 // Common IAM types and helpers are imported from the shared weed/iam package.
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -14,6 +15,7 @@ import (
 	"sync"
 
 	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/seaweedfs/seaweedfs/weed/credential"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	iamlib "github.com/seaweedfs/seaweedfs/weed/iam"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -1312,6 +1314,115 @@ func (iama *IamApiServer) handleImplicitUsername(r *http.Request, values url.Val
 	values.Set("UserName", identity.Name)
 }
 
+// targetedCredentialManager returns the credential manager through which a change to the named
+// identity is written on its own instead of via SaveConfiguration, or nil when this server has
+// none, or the identity is static: static identities live outside the store and keep the
+// full-save path.
+func (iama *IamApiServer) targetedCredentialManager(userName string) *credential.CredentialManager {
+	if iama.iam == nil {
+		return nil
+	}
+	cm := iama.iam.GetCredentialManager()
+	if cm == nil || cm.IsStaticIdentity(userName) {
+		return nil
+	}
+	return cm
+}
+
+// findIdentityByName returns the identity named userName in s3cfg, or nil.
+func findIdentityByName(s3cfg *iam_pb.S3ApiConfiguration, userName string) *iam_pb.Identity {
+	for _, ident := range s3cfg.Identities {
+		if ident.Name == userName {
+			return ident
+		}
+	}
+	return nil
+}
+
+// groupsWithMember returns the groups in s3cfg that list userName as a member. Taken before a
+// handler renames or removes the user, it names the group records that handler will change.
+func groupsWithMember(s3cfg *iam_pb.S3ApiConfiguration, userName string) []*iam_pb.Group {
+	var groups []*iam_pb.Group
+	for _, g := range s3cfg.Groups {
+		for _, m := range g.Members {
+			if m == userName {
+				groups = append(groups, g)
+				break
+			}
+		}
+	}
+	return groups
+}
+
+// serviceAccountsOf returns the service accounts in s3cfg whose parent is userName.
+func serviceAccountsOf(s3cfg *iam_pb.S3ApiConfiguration, userName string) []*iam_pb.ServiceAccount {
+	var accounts []*iam_pb.ServiceAccount
+	for _, sa := range s3cfg.ServiceAccounts {
+		if sa.ParentUser == userName {
+			accounts = append(accounts, sa)
+		}
+	}
+	return accounts
+}
+
+// persistIdentity writes the one identity a handler changed in s3cfg through the credential
+// manager. The store writes that identity's record and propagates it alone; the other
+// identities are not rewritten.
+func persistIdentity(ctx context.Context, cm *credential.CredentialManager, s3cfg *iam_pb.S3ApiConfiguration, userName string) error {
+	ident := findIdentityByName(s3cfg, userName)
+	if ident == nil {
+		return credential.ErrUserNotFound
+	}
+	return cm.UpdateUser(ctx, userName, ident)
+}
+
+// persistRenamedIdentity writes a user renamed from oldName to newName by UpdateUser through the
+// credential manager: the identity, the groups that listed the old name and the service accounts
+// it parented. UpdateUser under the old name moves the record in stores that treat a changed Name
+// as a rename (filer_etc, memory), and the propagating store propagates the new identity and the
+// old name's removal; UpdateUser already moved the inline policies through PutPolicies. A store
+// that did not move the record still holds the user under the old name; the caller is told so
+// (false) and keeps the full save, which is what renames such a store today.
+func persistRenamedIdentity(ctx context.Context, cm *credential.CredentialManager, s3cfg *iam_pb.S3ApiConfiguration, oldName, newName string, groups []*iam_pb.Group, accounts []*iam_pb.ServiceAccount) (bool, error) {
+	ident := findIdentityByName(s3cfg, newName)
+	if ident == nil {
+		return false, credential.ErrUserNotFound
+	}
+	if err := cm.UpdateUser(ctx, oldName, ident); err != nil {
+		return false, err
+	}
+	if _, err := cm.GetUser(ctx, newName); err != nil {
+		return false, nil
+	}
+	for _, g := range groups {
+		if err := cm.UpdateGroup(ctx, g); err != nil {
+			return false, fmt.Errorf("update group %s: %w", g.Name, err)
+		}
+	}
+	for _, sa := range accounts {
+		if err := cm.UpdateServiceAccount(ctx, sa.Id, sa); err != nil {
+			return false, fmt.Errorf("update service account %s: %w", sa.Id, err)
+		}
+	}
+	return true, nil
+}
+
+// deleteIdentity removes a user deleted by DeleteUser through the credential manager: its record
+// (the store propagates the one removal) and the groups that listed it, whose membership
+// DeleteUser already changed in s3cfg. DeleteUser already removed the inline policies through
+// PutPolicies.
+func deleteIdentity(ctx context.Context, cm *credential.CredentialManager, userName string, groups []*iam_pb.Group) error {
+	if err := cm.DeleteUser(ctx, userName); err != nil {
+		return err
+	}
+	for _, g := range groups {
+		if err := cm.UpdateGroup(ctx, g); err != nil {
+			return fmt.Errorf("update group %s: %w", g.Name, err)
+		}
+	}
+	return nil
+}
+
 func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 	// Lock to prevent concurrent read-modify-write race conditions
 	policyLock.Lock()
@@ -1333,6 +1444,9 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 	glog.V(4).Infof("DoActions: %+v", iamlib.RedactSensitiveFormValues(values))
 	var response iamlib.RequestIDSetter
 	changed := true
+	// persisted is set by the actions that wrote one identity through the credential manager
+	// instead of SaveConfiguration; the in-memory identity maps are reloaded after them too.
+	persisted := false
 	switch r.Form.Get("Action") {
 	case "ListUsers":
 		response = iama.ListUsers(s3cfg, values)
@@ -1365,40 +1479,107 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 		}
 		changed = false
 	case "UpdateUser":
+		userName, newUserName := values.Get("UserName"), values.Get("NewUserName")
+		// Taken before the rename: the records the handler changes besides the identity.
+		groups := groupsWithMember(s3cfg, userName)
+		accounts := serviceAccountsOf(s3cfg, userName)
 		var err *IamError
 		response, err = iama.UpdateUser(s3cfg, values)
 		if err != nil {
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		// Write the renamed identity, its groups and service accounts through the credential
+		// manager instead of rewriting every identity via SaveConfiguration. A request that
+		// renames nothing changed nothing, so there is nothing to write either way.
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			renamed := true
+			if newUserName != "" && newUserName != userName {
+				var err error
+				renamed, err = persistRenamedIdentity(r.Context(), cm, s3cfg, userName, newUserName, groups, accounts)
+				if err != nil {
+					writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+					return
+				}
+			}
+			changed, persisted = !renamed, renamed
+		}
 	case "DeleteUser":
 		userName := values.Get("UserName")
+		groups := groupsWithMember(s3cfg, userName)
 		var err *IamError
 		response, err = iama.DeleteUser(s3cfg, userName)
 		if err != nil {
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		// Targeted delete: one record removed and one removal propagated, plus the groups whose
+		// membership changed, instead of rewriting every remaining identity.
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			if err := deleteIdentity(r.Context(), cm, userName, groups); err != nil {
+				writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+				return
+			}
+			changed, persisted = false, true
+		}
 	case "CreateAccessKey":
 		iama.handleImplicitUsername(r, values)
-		var err *IamError
-		response, err = iama.CreateAccessKey(s3cfg, values)
+		userName := values.Get("UserName")
+		resp, err := iama.CreateAccessKey(s3cfg, values)
 		if err != nil {
 			glog.Errorf("CreateAccessKey: %+v", err.Error)
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		response = resp
+		// Targeted write: credentialManager.CreateAccessKey adds the key to the one identity and
+		// propagates that identity alone. The handler creates the identity for a user it does
+		// not know; that case still needs the full save.
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			if _, known := cm.GetUser(r.Context(), userName); known == nil {
+				cred := &iam_pb.Credential{
+					AccessKey: *resp.CreateAccessKeyResult.AccessKey.AccessKeyId,
+					SecretKey: *resp.CreateAccessKeyResult.AccessKey.SecretAccessKey,
+					Status:    accessKeyStatusActive,
+				}
+				if err := cm.CreateAccessKey(r.Context(), userName, cred); err != nil {
+					writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+					return
+				}
+				changed, persisted = false, true
+			}
+		}
 	case "DeleteAccessKey":
 		iama.handleImplicitUsername(r, values)
+		userName, accessKeyId := values.Get("UserName"), values.Get("AccessKeyId")
 		response = iama.DeleteAccessKey(s3cfg, values)
+		// Targeted write: credentialManager.DeleteAccessKey removes the key from the one identity
+		// and propagates that identity alone. The handler answers 200 for a key or user it does
+		// not know, so a not-found from the store is the same no-op it always was.
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			err := cm.DeleteAccessKey(r.Context(), userName, accessKeyId)
+			if err != nil && !errors.Is(err, credential.ErrAccessKeyNotFound) && !errors.Is(err, credential.ErrUserNotFound) {
+				writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+				return
+			}
+			changed, persisted = false, true
+		}
 	case "UpdateAccessKey":
 		iama.handleImplicitUsername(r, values)
+		userName := values.Get("UserName")
 		var err *IamError
 		response, err = iama.UpdateAccessKey(s3cfg, values)
 		if err != nil {
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			if err := persistIdentity(r.Context(), cm, s3cfg, userName); err != nil {
+				writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+				return
+			}
+			changed, persisted = false, true
+		}
 	case "CreatePolicy":
 		var err *IamError
 		response, err = iama.CreatePolicy(s3cfg, values)
@@ -1410,6 +1591,7 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 		// The `changed` flag is false because this does not modify the main s3cfg.Identities configuration.
 		changed = false
 	case "PutUserPolicy":
+		userName := values.Get("UserName")
 		var err *IamError
 		response, err = iama.PutUserPolicy(s3cfg, values)
 		if err != nil {
@@ -1417,6 +1599,15 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		// The policy document is already stored through PutPolicies; what remains is the
+		// identity's recomputed Actions, written and propagated for that identity alone.
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			if err := persistIdentity(r.Context(), cm, s3cfg, userName); err != nil {
+				writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+				return
+			}
+			changed, persisted = false, true
+		}
 	case "GetUserPolicy":
 		var err *IamError
 		response, err = iama.GetUserPolicy(s3cfg, values)
@@ -1426,12 +1617,20 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 		}
 		changed = false
 	case "DeleteUserPolicy":
+		userName := values.Get("UserName")
 		var err *IamError
 		response, err = iama.DeleteUserPolicy(s3cfg, values)
 		if err != nil {
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			if err := persistIdentity(r.Context(), cm, s3cfg, userName); err != nil {
+				writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+				return
+			}
+			changed, persisted = false, true
+		}
 	case "ListUserPolicies":
 		iama.handleImplicitUsername(r, values)
 		var err *IamError
@@ -1642,6 +1841,8 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 			writeIamErrorResponse(w, r, reqID, &iamError)
 			return
 		}
+	}
+	if changed || persisted {
 		// Reload in-memory identity maps so subsequent LookupByAccessKey calls
 		// can see newly created or deleted keys immediately
 		if iama.iam != nil {

weed/iamapi/iamapi_targeted_writes_test.go

@@ -0,0 +1,302 @@
+package iamapi
+
+// Targeted-write regression tests: single-identity IAM actions must write only
+// the identity they changed through the credential manager, not every identity
+// via PutS3ApiConfiguration/SaveConfiguration.
+// See https://github.com/seaweedfs/seaweedfs/issues/11865.
+
+import (
+	"context"
+	"net/http"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// targetedRecordingStore wraps a memory store and counts the write methods
+// the dispatcher used, so a test can assert the single-identity path was
+// taken. It embeds the concrete store (rather than the CredentialStore
+// interface) so optional interfaces like InlinePolicyStore stay visible
+// through the wrapper.
+type targetedRecordingStore struct {
+	*memory.MemoryStore
+	saves            int
+	createAccessKeys int
+	deleteAccessKeys int
+	updateUsers      int
+	deleteUsers      int
+	updateGroups     int
+}
+
+func (r *targetedRecordingStore) SaveConfiguration(ctx context.Context, config *iam_pb.S3ApiConfiguration) error {
+	r.saves++
+	return r.MemoryStore.SaveConfiguration(ctx, config)
+}
+
+func (r *targetedRecordingStore) CreateAccessKey(ctx context.Context, username string, cred *iam_pb.Credential) error {
+	r.createAccessKeys++
+	return r.MemoryStore.CreateAccessKey(ctx, username, cred)
+}
+
+func (r *targetedRecordingStore) DeleteAccessKey(ctx context.Context, username string, accessKey string) error {
+	r.deleteAccessKeys++
+	return r.MemoryStore.DeleteAccessKey(ctx, username, accessKey)
+}
+
+func (r *targetedRecordingStore) UpdateUser(ctx context.Context, username string, identity *iam_pb.Identity) error {
+	r.updateUsers++
+	return r.MemoryStore.UpdateUser(ctx, username, identity)
+}
+
+func (r *targetedRecordingStore) DeleteUser(ctx context.Context, username string) error {
+	r.deleteUsers++
+	return r.MemoryStore.DeleteUser(ctx, username)
+}
+
+func (r *targetedRecordingStore) UpdateGroup(ctx context.Context, group *iam_pb.Group) error {
+	r.updateGroups++
+	return r.MemoryStore.UpdateGroup(ctx, group)
+}
+
+func targetedIamApiServer() (*IamApiServer, *credential.CredentialManager, *countingConfigSaver, *targetedRecordingStore) {
+	srv, cm, counter := iamApiServerWithCredentialManager()
+	rec := &targetedRecordingStore{MemoryStore: cm.Store.(*memory.MemoryStore)}
+	cm.Store = rec
+	return srv, cm, counter, rec
+}
+
+const targetedTestPolicy = `{
+	"Version": "2012-10-17",
+	"Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": ["arn:aws:s3:::bench/*"]}]
+}`
+
+func TestIamApiCreateAccessKeyTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}))
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "bob"}))
+
+	req, _ := iam.New(session.New()).CreateAccessKeyRequest(&iam.CreateAccessKeyInput{UserName: aws.String("alice")})
+	_ = req.Build()
+	out := CreateAccessKeyResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "CreateAccessKey must not PutS3ApiConfiguration")
+	assert.Equal(t, 0, rec.saves)
+	assert.Equal(t, 1, rec.createAccessKeys)
+
+	ident, err := cm.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	require.Len(t, ident.Credentials, 1)
+	assert.Equal(t, *out.CreateAccessKeyResult.AccessKey.AccessKeyId, ident.Credentials[0].AccessKey)
+}
+
+// CreateAccessKey for a user the store does not know still needs the full save:
+// the handler creates the identity in the config, so there is no existing
+// record to write a key into.
+func TestIamApiCreateAccessKeyUnknownUserFallsBack(t *testing.T) {
+	srv, cm, counter, _ := targetedIamApiServer()
+	ctx := context.Background()
+
+	req, _ := iam.New(session.New()).CreateAccessKeyRequest(&iam.CreateAccessKeyInput{UserName: aws.String("ghost")})
+	_ = req.Build()
+	out := CreateAccessKeyResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 1, counter.putCalled)
+	ident, err := cm.GetUser(ctx, "ghost")
+	require.NoError(t, err)
+	assert.Len(t, ident.Credentials, 1)
+}
+
+func TestIamApiDeleteAccessKeyTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{
+		Name:        "alice",
+		Credentials: []*iam_pb.Credential{{AccessKey: "AKIATESTFAKEKEY00001", SecretKey: "testsecretfake"}},
+	}))
+
+	req, _ := iam.New(session.New()).DeleteAccessKeyRequest(&iam.DeleteAccessKeyInput{
+		UserName:    aws.String("alice"),
+		AccessKeyId: aws.String("AKIATESTFAKEKEY00001"),
+	})
+	_ = req.Build()
+	out := DeleteAccessKeyResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "DeleteAccessKey must not PutS3ApiConfiguration")
+	assert.Equal(t, 1, rec.deleteAccessKeys)
+
+	ident, err := cm.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	assert.Empty(t, ident.Credentials)
+
+	// Deleting a key that does not exist still answers 200 and stays targeted.
+	req, _ = iam.New(session.New()).DeleteAccessKeyRequest(&iam.DeleteAccessKeyInput{
+		UserName:    aws.String("alice"),
+		AccessKeyId: aws.String("AKIATESTFAKEKEY99999"),
+	})
+	_ = req.Build()
+	resp, err = executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+	assert.Equal(t, 0, counter.putCalled)
+}
+
+func TestIamApiUpdateAccessKeyTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{
+		Name:        "alice",
+		Credentials: []*iam_pb.Credential{{AccessKey: "AKIATESTFAKEKEY00001", SecretKey: "testsecretfake", Status: "Active"}},
+	}))
+
+	req, _ := iam.New(session.New()).UpdateAccessKeyRequest(&iam.UpdateAccessKeyInput{
+		UserName:    aws.String("alice"),
+		AccessKeyId: aws.String("AKIATESTFAKEKEY00001"),
+		Status:      aws.String(iam.StatusTypeInactive),
+	})
+	_ = req.Build()
+	out := UpdateAccessKeyResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "UpdateAccessKey must not PutS3ApiConfiguration")
+	assert.Equal(t, 1, rec.updateUsers)
+
+	ident, err := cm.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	require.Len(t, ident.Credentials, 1)
+	assert.Equal(t, iam.StatusTypeInactive, ident.Credentials[0].Status)
+}
+
+func TestIamApiPutUserPolicyTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}))
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "bob"}))
+
+	req, _ := iam.New(session.New()).PutUserPolicyRequest(&iam.PutUserPolicyInput{
+		UserName:       aws.String("alice"),
+		PolicyName:     aws.String("read-bench"),
+		PolicyDocument: aws.String(targetedTestPolicy),
+	})
+	_ = req.Build()
+	out := PutUserPolicyResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "PutUserPolicy must not PutS3ApiConfiguration")
+	assert.Equal(t, 0, rec.saves)
+	assert.Equal(t, 1, rec.updateUsers)
+
+	ident, err := cm.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	assert.NotEmpty(t, ident.Actions, "recomputed Actions must be persisted for the one identity")
+}
+
+func TestIamApiDeleteUserPolicyTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}))
+
+	putReq, _ := iam.New(session.New()).PutUserPolicyRequest(&iam.PutUserPolicyInput{
+		UserName:       aws.String("alice"),
+		PolicyName:     aws.String("read-bench"),
+		PolicyDocument: aws.String(targetedTestPolicy),
+	})
+	_ = putReq.Build()
+	putOut := PutUserPolicyResponse{}
+	resp, err := executeRequestWith(srv, putReq.HTTPRequest, &putOut)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	delReq, _ := iam.New(session.New()).DeleteUserPolicyRequest(&iam.DeleteUserPolicyInput{
+		UserName:   aws.String("alice"),
+		PolicyName: aws.String("read-bench"),
+	})
+	_ = delReq.Build()
+	delOut := DeleteUserPolicyResponse{}
+	resp, err = executeRequestWith(srv, delReq.HTTPRequest, &delOut)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "DeleteUserPolicy must not PutS3ApiConfiguration")
+	assert.Equal(t, 2, rec.updateUsers)
+
+	policies := Policies{}
+	require.NoError(t, srv.s3ApiConfig.GetPolicies(&policies))
+	assert.Empty(t, policies.InlinePolicies["alice"])
+}
+
+func TestIamApiUpdateUserRenameTargeted(t *testing.T) {
+	srv, cm, counter, _ := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}))
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "bob"}))
+	require.NoError(t, cm.CreateGroup(ctx, &iam_pb.Group{Name: "devs", Members: []string{"alice", "bob"}}))
+
+	req, _ := iam.New(session.New()).UpdateUserRequest(&iam.UpdateUserInput{
+		UserName:    aws.String("alice"),
+		NewUserName: aws.String("alice-renamed"),
+	})
+	_ = req.Build()
+	out := UpdateUserResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "UpdateUser rename must not PutS3ApiConfiguration")
+
+	_, err = cm.GetUser(ctx, "alice")
+	require.ErrorIs(t, err, credential.ErrUserNotFound)
+	_, err = cm.GetUser(ctx, "alice-renamed")
+	require.NoError(t, err)
+
+	g, err := cm.GetGroup(ctx, "devs")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"alice-renamed", "bob"}, g.Members)
+}
+
+func TestIamApiDeleteUserTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}))
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "bob"}))
+	require.NoError(t, cm.CreateGroup(ctx, &iam_pb.Group{Name: "devs", Members: []string{"alice", "bob"}}))
+
+	req, _ := iam.New(session.New()).DeleteUserRequest(&iam.DeleteUserInput{UserName: aws.String("alice")})
+	_ = req.Build()
+	out := DeleteUserResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "DeleteUser must not PutS3ApiConfiguration")
+	assert.Equal(t, 1, rec.deleteUsers)
+	assert.Equal(t, 1, rec.updateGroups)
+
+	_, err = cm.GetUser(ctx, "alice")
+	require.ErrorIs(t, err, credential.ErrUserNotFound)
+	g, err := cm.GetGroup(ctx, "devs")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"bob"}, g.Members)
+	_, err = cm.GetUser(ctx, "bob")
+	require.NoError(t, err, "other identities must be untouched")
+}

weed/iamapi/iamapi_test.go

@@ -17,6 +17,7 @@ import (
 	"github.com/jinzhu/copier"
 	"github.com/seaweedfs/seaweedfs/weed/credential"
 	"github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
@@ -607,6 +608,7 @@ func iamApiServerWithCredentialManager() (*IamApiServer, *credential.CredentialM
 type countingConfigSaver struct {
 	cm        *credential.CredentialManager
 	putCalled int
+	policies  Policies
 }
 
 func (c *countingConfigSaver) GetS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) error {
@@ -616,6 +618,8 @@ func (c *countingConfigSaver) GetS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfigura
 	}
 	s3cfg.Identities = config.Identities
 	s3cfg.Policies = config.Policies
+	s3cfg.Groups = config.Groups
+	s3cfg.ServiceAccounts = config.ServiceAccounts
 	return nil
 }
 
@@ -625,10 +629,15 @@ func (c *countingConfigSaver) PutS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfigura
 }
 
 func (c *countingConfigSaver) GetPolicies(policies *Policies) error {
+	*policies = c.policies
+	if c.policies.Policies == nil && c.policies.InlinePolicies == nil {
+		return filer_pb.ErrNotFound
+	}
 	return nil
 }
 
 func (c *countingConfigSaver) PutPolicies(policies *Policies) error {
+	c.policies = *policies
 	return nil
 }