seaweedfs

Github-Mirror/seaweedfs

0 Fork 0

mirror of https://github.com/seaweedfs/seaweedfs.git synced 2026-10-19 20:44:28 +02:00

Files

T

History

eea3f232da iam: scope CreateServiceAccount's ParentUser by policy resource (#11736 )

* iam: scope CreateServiceAccount's ParentUser by policy resource

AuthorizeIamAction evaluated the iam:CreateServiceAccount grant against a
hardcoded arn:aws:iam:::* resource, so the policy's Resource never had a
say; #11218 then bound the target to the caller outright. Evaluate
self-target actions against the target identity's ARN instead: a wildcard
resource keeps the deliberate any-target grant, a scoped resource confines
issuance to the named parent identity, anything else is denied.

buildResourceARN gains the ARN pass-through buildS3ResourceArn already has,
so iam: ARNs reach the policy engine intact on the attached-policies route.

Closes #11735

* ci: retrigger after unrelated weed/storage metrics flake

* iam: fold IAM-ARN matching into awsIAMMatch, drop debug test

- remove zz_debug_test.go (local debugging leftover)
- fold awsIAMMatchResource into awsIAMMatch: the arn:aws:iam:: value
  prefix selects case-sensitive matching, so no separate name is needed
- trim comments

---------

Co-authored-by: batonogov <batonogov@users.noreply.github.com>
Co-authored-by: Chris Lu <chris.lu@gmail.com>

2026-10-18 11:48:01 -07:00

aws_iam_compliance_test.go

fix(s3): populate s3:prefix from query param for ListObjects policy conditions (#8971 )

2026-04-07 13:21:30 -07:00

cached_policy_store_generic.go

S3 API: Advanced IAM System (#7160 )

2025-08-30 11:15:48 -07:00

jwt_claim_variables_test.go

fix(iam): substitute dynamic jwt:/saml:/oidc: claim variables in policies (#9217 )

2026-04-24 13:08:24 -07:00

policy_engine_distributed_test.go

S3: Enforce bucket policy (#7471 )