Chris LuandClaude Opus 5.5 fc8f4c6ecb s3tables: re-anchor legacy owners for federated STS sessions ...

A web-identity role session was keyed on its bare OIDC subject until
owners became issuer-scoped. Its sessions now carry the scoped aws:userid
but no asserted issuers, so the legacy subject check never applied and the
session lost the table buckets and namespaces it had created. Read the
configured issuer set for such sessions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-13 02:56:59 -08:00

..

s3tablestest

fix(s3tables): let DeleteTableBucket remove empty leftover directories (#12307)

2026-11-01 13:43:15 -08:00

filer_ops_race_test.go

s3, s3tables: create buckets and namespaces exclusively (#11872)

2026-10-20 19:01:08 -07:00

filer_ops_test.go

fix(s3tables): keep the data under a deleted namespace (#12276)

2026-10-31 05:27:58 -07:00

filer_ops.go

fix(s3tables): let a table renamed across namespaces keep committing (#12515)

2026-11-10 21:15:48 -08:00

handler_bind_authorized_test.go

fix(s3tables,s3vectors): bind DeleteNamespace and the vector bucket cleanup to the authorized records (#12331)

2026-11-02 09:55:09 -08:00

handler_bind_bucket_test.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

handler_bind_tags_test.go

s3vectors: support TagResource, UntagResource and ListTagsForResource (#12335)

2026-11-02 10:33:26 -08:00

handler_bucket_create.go

s3vectors: encrypt the objects of a vector bucket declared AES256 (#12324)

2026-11-01 23:57:40 -08:00

handler_bucket_format_test.go

s3vectors: encrypt the objects of a vector bucket declared AES256 (#12324)

2026-11-01 23:57:40 -08:00

handler_bucket_get_list_delete.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

handler_bucket_keeps_data_test.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

handler_delete_create_race_test.go

fix(s3tables): bind table and view writes to the record they were authorized against (#12328)

2026-11-02 02:50:45 -08:00

handler_delete_decouple_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_delete_replacement_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_existence_hiding_test.go

s3tables, iceberg: one catalog record per table location (#12473)

2026-11-07 05:04:09 -08:00

handler_identity_test.go

s3tables: scope the anonymous identity's grant on the table catalogs (#12056)

2026-10-25 06:13:22 -07:00

handler_location_owner_test.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

handler_log_level_test.go

s3tables, iceberg: log client refusals at V(1), not ERROR (#11896)

2026-10-21 14:00:33 -07:00

handler_maintenance_test.go

s3tables: add the maintenance configuration APIs (#10773)

2026-08-16 10:36:59 -07:00

handler_maintenance.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

handler_name_charset_test.go

s3tables: allow hyphens in namespace and table names (#10093)

2026-06-24 16:24:45 -07:00

handler_namespace_keeps_data_test.go

fix(s3tables): keep the data under a deleted namespace (#12276)

2026-10-31 05:27:58 -07:00

handler_namespace_resolution_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_namespace.go

fix(s3tables,s3vectors): bind DeleteNamespace and the vector bucket cleanup to the authorized records (#12331)

2026-11-02 09:55:09 -08:00

handler_no_trace_errorf_test.go

s3tables, iceberg: log client refusals at V(1), not ERROR (#11896)

2026-10-21 14:00:33 -07:00

handler_ownerless_test.go

s3tables: only the admin repairs a table bucket that has no owner metadata (#11873)

2026-10-20 18:58:54 -07:00

handler_policy_condition_test.go

fix(s3tables): validate policy conditions and fail safe on unusable ones (#12389)

2026-11-04 08:13:05 -08:00

handler_policy_deny_test.go

s3tables: honor resource policy Deny on remaining operations (#11825)

2026-10-19 03:59:18 -07:00

handler_policy.go

s3vectors: support TagResource, UntagResource and ListTagsForResource (#12335)

2026-11-02 10:33:26 -08:00

handler_principal_test.go

s3vectors: resolve the caller like table buckets and honor bucket-scoped identity actions (#12319)

2026-11-01 23:50:19 -08:00

handler_rename_test.go

fix(s3tables): route REST RenameTable and refuse unrouted S3 Tables requests (#12446)

2026-11-06 09:32:13 -08:00

handler_renamed_source_test.go

fix(s3tables): answer 404 for a table name that was renamed away (#12258)

2026-10-30 19:53:57 -07:00

handler_table_test.go

fix(iceberg): serve a registered table's metadata on load and commit (#12159)

2026-10-28 08:15:42 -07:00

handler_table.go

fix(s3tables): let a table renamed across namespaces keep committing (#12515)

2026-11-10 21:15:48 -08:00

handler_update_after_rename_test.go

fix(s3tables): let a table renamed across namespaces keep committing (#12515)

2026-11-10 21:15:48 -08:00

handler_update_cas_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_update_conflict_test.go

fix(s3tables): bind table and view writes to the record they were authorized against (#12328)

2026-11-02 02:50:45 -08:00

handler_view_rename_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_view_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_view.go

fix(s3tables): let a table renamed across namespaces keep committing (#12515)

2026-11-10 21:15:48 -08:00

handler_warehouse_location_test.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

handler.go

s3tables: re-anchor legacy owners for federated STS sessions

2026-11-13 02:56:59 -08:00

iam.go

s3tables: scope the anonymous identity's grant on the table catalogs (#12056)

2026-10-25 06:13:22 -07:00

iceberg_layout_test.go

s3tables: accept Puffin statistics files in a table's metadata/ (#11892)

2026-10-21 12:19:53 -07:00

iceberg_layout.go

s3tables: accept Puffin statistics files in a table's metadata/ (#11892)

2026-10-21 12:19:53 -07:00

iceberg_manifest_list_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest_list.go

iceberg: read manifest lists that omit the Avro format version (#10475)

2026-07-28 16:42:17 -07:00

iceberg_manifest_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

manager_test.go

s3vectors: accept and return encryptionConfiguration on vector buckets (#12203)

2026-10-29 11:29:00 -07:00

manager.go

s3tables: re-anchor legacy owners for federated STS sessions

2026-11-13 02:56:59 -08:00

permissions_test.go

fix(s3tables): validate policy conditions and fail safe on unusable ones (#12389)

2026-11-04 08:13:05 -08:00

permissions.go

fix(s3tables): validate policy conditions and fail safe on unusable ones (#12389)

2026-11-04 08:13:05 -08:00

policy_case_test.go

s3vectors: authorize CreateVectorBucket as a vector action, close DeleteIndex race, fold policy service case (#12287)

2026-10-31 15:07:23 -07:00

table_data_dir_test.go

fix(iceberg): keep a losing table create from deleting the winner's metadata (#12474)

2026-11-07 10:54:04 -08:00

types.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

utils_location_test.go

s3tables: confine caller-supplied metadataLocation to the table's namespace

2026-10-12 02:41:28 -07:00

utils_namespace_test.go

iceberg: persist namespace properties for create/get (#8276)

2026-02-09 22:20:45 -08:00

utils.go

fix(s3tables): let a table renamed across namespaces keep committing (#12515)

2026-11-10 21:15:48 -08:00

vector_namespace_test.go

s3tables: keep the vector-namespace fence on a declare of an existing index (#12293)

2026-10-31 16:07:31 -07:00

vector_namespace.go

s3tables: keep the vector-namespace fence on a declare of an existing index (#12293)

2026-10-31 16:07:31 -07:00