Chris LuandClaude Opus 5.5 3e64326f2b s3: require their own actions to change a bucket's CORS or versioning (#12433) ...

* s3: require their own actions to change a bucket's CORS or versioning

PUT/DELETE ?cors and PUT ?versioning were authorized as Write, so an
identity granted only object writes on a bucket could replace its CORS
rules or suspend versioning. They now need PutBucketCors,
DeleteBucketCors and PutBucketVersioning (or Admin), and inline policies
granting s3:PutBucketCors, s3:DeleteBucketCors or s3:PutBucketVersioning
map to those actions instead of Write.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3: test that object Write cannot change bucket CORS or versioning

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* admin: offer the bucket CORS and versioning permissions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3: test each bucket config action with its own identity

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-06 09:12:00 -08:00

..

acp_canned_acl.go

s3: sync bucket info from filer (#3759)

2022-09-29 12:29:01 -07:00

acp_grantee_group.go

fix chunk.ModifiedTsNs (#4264)

2023-03-02 08:24:36 -08:00

acp_grantee_type.go

s3: sync bucket info from filer (#3759)

2022-09-29 12:29:01 -07:00

acp_ownership_test.go

s3: report the effective ownership when a bucket has none stored (#10591)

2026-08-05 13:15:28 -07:00

acp_ownership.go

s3: report the effective ownership when a bucket has none stored (#10591)

2026-08-05 13:15:28 -07:00

acp_permisson.go

s3: sync bucket info from filer (#3759)

2022-09-29 12:29:01 -07:00

buckets.go

admin: add bucket lifecycle rule editing (#10860)

2026-08-21 23:42:26 -07:00

crypto.go

s3api: resolve volume data encryption in CopyObject SSE flows (#11646) (#11683)

2026-10-10 10:59:36 +08:00

extend_key.go

s3api: per-bucket Block Public Access (BlockPublicAcls, IgnorePublicAcls) (#12381)

2026-11-03 14:52:20 -08:00

header_test.go

s3: end a catalog-vended session with the access key it was vended for (#11945)

2026-10-23 03:58:06 -07:00

header.go

s3api: let the vectors route, not the credential scope, raise the body limit (#12326)

2026-11-02 01:15:42 -08:00

s3_acp.go

[s3acl] Step1: move s3account.AccountManager into to iam.S3ApiConfiguration (#4859)

2023-09-25 08:34:12 -07:00

s3_action_strings.go

s3: resolve versionId ACL and attributes requests to the version-scoped actions (#11916)

2026-10-21 16:50:34 -07:00

s3_actions.go

s3: require their own actions to change a bucket's CORS or versioning (#12433)

2026-11-06 09:12:00 -08:00

s3_config.go

s3vectors: accept bodies up to the 32 MiB limit, report larger ones as a size error, log engine failures (#12320)

2026-11-02 00:18:44 -08:00