Chris LuandClaude Opus 5.5 66a6598fdd fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329) ...

* s3tables: bind table bucket policy writes to the authorized bucket

PutTableBucketPolicy compared only the policy bytes, and
DeleteTableBucketPolicy removed the policy unconditionally. A bucket deleted
and created again under the same name between authorization and the write
took a policy change nobody authorized for it. Both writes now require the
bucket's CreatedAt and the policy they were authorized against, answer 409
otherwise and 404 for a bucket that is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3tables: bind bucket tag writes to the authorized bucket

TagResource and UntagResource checked the creation time only for a table
ARN. On a bucket ARN the merged tags landed on a bucket deleted and created
again since authorization. extractResourceOwnerAndBucket now returns the
resource's CreatedAt for both kinds, and the write requires it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3tables: bind bucket maintenance writes to the authorized bucket

PutTableBucketMaintenanceConfiguration wrote onto whatever bucket held the
name at write time. authorizeMaintenanceBucket now returns the bucket's
CreatedAt like authorizeMaintenanceTable, and putMaintenanceConfiguration
takes the check and creation time from both callers instead of an optional
closure.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3vectors: bind vector bucket policy writes to the authorized bucket

Put/DeleteVectorBucketPolicy authorized inside the compare-and-swap with
the owner from an earlier bucket read, so a bucket deleted and created
again by another account in between had its policy rewritten by the old
owner. The mutation now requires the entry's createdAt to match the
record it authorized against.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3vectors: bind DeleteVectorBucket to the authorized bucket

DeleteVectorBucket authorized one bucket record, then ran the trusted
catalog DeleteTableBucket on whatever bucket held the name by then, so an
empty bucket deleted and created again by another account in between was
deleted by the old owner. The catalog delete now accepts the authorized
bucket's createdAt through an in-process context value and treats any
other bucket as gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3vectors: bind CreateIndex and DeleteIndex to the authorized bucket

Both authorized the bucket, then ran trusted CreateNamespace, CreateTable
or DeleteTable on whatever bucket held the name by then, so an index could
be created in, or deleted from, a bucket another account created again in
between. Those catalog operations now honor the bucket binding
DeleteTableBucket already takes, and the vector handlers pass the
authorized bucket's createdAt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-02 03:00:30 -08:00

..

auth_fix_test.go

s3vectors: authorize CreateVectorBucket as a vector action, close DeleteIndex race, fold policy service case (#12287)

2026-10-31 15:07:23 -07:00

auth_test.go

s3api: let the vectors route, not the credential scope, raise the body limit (#12326)

2026-11-02 01:15:42 -08:00

bind_bucket_test.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

conformance_test.go

s3vectors: e2e conformance for vector bucket policy evaluation (#12221)

2026-10-29 16:19:22 -07:00

distance_metric_test.go

s3vectors: report the Euclidean distance, not its square (#12318)

2026-11-01 23:50:46 -08:00

handlers_test.go

s3vectors: accept bodies up to the 32 MiB limit, report larger ones as a size error, log engine failures (#12320)

2026-11-02 00:18:44 -08:00

handlers.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

list_bounds_test.go

vector: keep ListVectors pages and segments flat as an index grows; read only keys in GetVectors (#12300)

2026-11-01 11:57:44 -08:00

owner_check_test.go

s3vectors: keep bucket policies in vector form and evaluate them in the gateway (#12214)

2026-10-29 13:35:34 -07:00

principal_test.go

s3vectors: resolve the caller like table buckets and honor bucket-scoped identity actions (#12319)

2026-11-01 23:50:19 -08:00

server.go

s3api: let the vectors route, not the credential scope, raise the body limit (#12326)

2026-11-02 01:15:42 -08:00

types.go

s3vectors: accept bodies up to the 32 MiB limit, report larger ones as a size error, log engine failures (#12320)

2026-11-02 00:18:44 -08:00

vector_namespace_test.go

s3tables: make the vector namespace of a vector bucket read-only (#12292)

2026-10-31 15:36:48 -07:00