Chris LuandDevin 00804b32fa s3tables: let an explicit policy Deny veto fallback and owner allows (#11772) ...

* s3tables: let an explicit policy Deny veto fallback and owner allows

Table operations evaluated the table or namespace policy and the bucket
policy as an OR, so an explicit Deny in one policy was overridden by an
Allow in the other. Owner and identity grants also short-circuited
before the resource policy was read. Deny statements are now evaluated
first at both levels, matching AWS explicit-deny semantics.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* s3tables: fail closed when a resource side has no owner

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-10-16 19:54:46 -07:00

..

s3tablestest

avro: field time.Time <> iceberg.date (#11091)

2026-09-02 17:24:23 -07:00

filer_ops_test.go

Report a delete the filer rejected instead of answering success (#11003)

2026-08-27 22:29:48 -07:00

filer_ops.go

Report a delete the filer rejected instead of answering success (#11003)

2026-08-27 22:29:48 -07:00

handler_bucket_create.go

s3tables: scope OIDC-derived account IDs to the token issuer (#11774)

2026-10-16 19:48:32 -07:00

handler_bucket_format_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_bucket_get_list_delete.go

s3tables: scope OIDC-derived account IDs to the token issuer (#11774)

2026-10-16 19:48:32 -07:00

handler_delete_decouple_test.go

s3tables: check data-path ancestors for catalog markers on DeleteTable

2026-10-12 02:41:28 -07:00

handler_existence_hiding_test.go

catalog: refused writes answer 403 to callers that can read the entry (#11650)

2026-10-09 09:59:32 +08:00

handler_identity_test.go

s3tables: scope OIDC-derived account IDs to the token issuer (#11774)

2026-10-16 19:48:32 -07:00

handler_maintenance_test.go

s3tables: add the maintenance configuration APIs (#10773)

2026-08-16 10:36:59 -07:00

handler_maintenance.go

s3tables: scope OIDC-derived account IDs to the token issuer (#11774)

2026-10-16 19:48:32 -07:00

handler_name_charset_test.go

s3tables: allow hyphens in namespace and table names (#10093)

2026-06-24 16:24:45 -07:00

handler_namespace_resolution_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_namespace.go

s3tables: scope OIDC-derived account IDs to the token issuer (#11774)

2026-10-16 19:48:32 -07:00

handler_policy.go

s3tables: scope OIDC-derived account IDs to the token issuer (#11774)

2026-10-16 19:48:32 -07:00

handler_principal_test.go

s3api: unify auth error handling across s3tables, iceberg and lance (#11381)

2026-09-18 01:01:04 -07:00

handler_rename_test.go

s3tables: hide inaccessible catalog resources (#11365)

2026-09-17 11:43:52 -07:00

handler_table_test.go

iceberg: support table register (#10067)

2026-06-23 14:07:13 -07:00

handler_table.go

s3tables: let an explicit policy Deny veto fallback and owner allows (#11772)

2026-10-16 19:54:46 -07:00

handler_update_cas_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_view_rename_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_view_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_view.go

s3tables: let an explicit policy Deny veto fallback and owner allows (#11772)

2026-10-16 19:54:46 -07:00

handler.go

s3tables: scope OIDC-derived account IDs to the token issuer (#11774)

2026-10-16 19:48:32 -07:00

iam.go

s3api: tolerate session tokens on statically configured credentials (#11694)

2026-10-10 10:11:24 +08:00

iceberg_layout_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

iceberg_layout.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

iceberg_manifest_list_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest_list.go

iceberg: read manifest lists that omit the Avro format version (#10475)

2026-07-28 16:42:17 -07:00

iceberg_manifest_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

manager_test.go

s3tables: scope management authorization to the caller's identity (#9961)

2026-06-14 13:55:36 -07:00

manager.go

Authorize an Iceberg table create before it writes (#10991)

2026-08-27 16:23:51 -07:00

permissions_test.go

s3tables: let an explicit policy Deny veto fallback and owner allows (#11772)

2026-10-16 19:54:46 -07:00

permissions.go

s3tables: let an explicit policy Deny veto fallback and owner allows (#11772)

2026-10-16 19:54:46 -07:00

table_data_dir_test.go

iceberg: make a table commit a compare-and-swap (#10775)

2026-08-16 12:55:42 -07:00

types.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

utils_location_test.go

s3tables: confine caller-supplied metadataLocation to the table's namespace

2026-10-12 02:41:28 -07:00

utils_namespace_test.go

iceberg: persist namespace properties for create/get (#8276)

2026-02-09 22:20:45 -08:00

utils.go

s3tables: confine caller-supplied metadataLocation to the table's namespace

2026-10-12 02:41:28 -07:00