seaweedfs

mirror of https://github.com/seaweedfs/seaweedfs.git synced 2026-09-16 11:30:44 +02:00

Files

T

Chris Lu 87474c2f21 s3: let attached policies authorize CreateBucket (#11049 )

* s3: resolve admin bucket subresources to their specific S3 actions

Encryption, requestPayment, publicAccessBlock and ownershipControls
requests reached the policy engines as s3:*, so only a policy granting
all of s3 could authorize them. Map each subresource to its AWS action,
with DELETE sharing the PUT permission as AWS does.

Claude-Session: https://claude.ai/code/session_01XH7iM88ZqWMEvsLB8tkWPQ

* s3: authorize CreateBucket as s3:CreateBucket in the policy engine

A plain bucket-level PUT is registered with ACTION_ADMIN, which resolved
to s3:*, so no attached policy short of s3:* could match it. Federated
sessions whose policy explicitly allowed s3:CreateBucket were always
denied while the same policy worked for object operations. Resolve it to
s3:CreateBucket, like DeleteBucket already resolves.

Claude-Session: https://claude.ai/code/session_01XH7iM88ZqWMEvsLB8tkWPQ

2026-08-31 10:24:22 -07:00

acp_canned_acl.go

s3: sync bucket info from filer (#3759 )

2022-09-29 12:29:01 -07:00

acp_grantee_group.go

fix chunk.ModifiedTsNs (#4264 )

2023-03-02 08:24:36 -08:00

acp_grantee_type.go

s3: sync bucket info from filer (#3759 )

2022-09-29 12:29:01 -07:00

acp_ownership_test.go

s3: report the effective ownership when a bucket has none stored (#10591 )