update wiki for iam groups

2026-10-25 22:40:44 +01:00 · 2026-03-10 14:19:43 -07:00
1 parent 52226341de
commit c16a4d99ce
@@ -333,6 +333,94 @@ aws --endpoint $AWS_ENDPOINT iam delete-policy \

 ---

+## Group Management
+
+Groups allow you to organize users and apply policies at the group level. Policies attached to a group are evaluated for all group members during S3 authorization.
+
+### Create a Group
+
+```bash
+aws --endpoint $AWS_ENDPOINT iam create-group --group-name developers
+```
+
+Output:
+```json
+{
+    "Group": {
+        "GroupName": "developers"
+    }
+}
+```
+
+### List Groups
+
+```bash
+aws --endpoint $AWS_ENDPOINT iam list-groups
+```
+
+### Get Group Details (including members)
+
+```bash
+aws --endpoint $AWS_ENDPOINT iam get-group --group-name developers
+```
+
+### Add User to Group
+
+```bash
+aws --endpoint $AWS_ENDPOINT iam add-user-to-group --group-name developers --user-name bob
+```
+
+### Remove User from Group
+
+```bash
+aws --endpoint $AWS_ENDPOINT iam remove-user-from-group --group-name developers --user-name bob
+```
+
+### Attach Policy to Group
+
+```bash
+aws --endpoint $AWS_ENDPOINT iam attach-group-policy \
+  --group-name developers \
+  --policy-arn arn:aws:iam:::policy/ReadOnlyPolicy
+```
+
+### List Policies Attached to Group
+
+```bash
+aws --endpoint $AWS_ENDPOINT iam list-attached-group-policies --group-name developers
+```
+
+### Detach Policy from Group
+
+```bash
+aws --endpoint $AWS_ENDPOINT iam detach-group-policy \
+  --group-name developers \
+  --policy-arn arn:aws:iam:::policy/ReadOnlyPolicy
+```
+
+### List Groups for a User
+
+```bash
+aws --endpoint $AWS_ENDPOINT iam list-groups-for-user --user-name bob
+```
+
+### Delete a Group
+
+> **Note**: A group must have no members and no attached policies before it can be deleted.
+
+```bash
+aws --endpoint $AWS_ENDPOINT iam delete-group --group-name developers
+```
+
+### Key Behaviors
+
+- **Group policies**: Policies attached to a group apply to all members during S3 authorization
+- **Disabled groups**: Groups can be disabled/enabled (SeaweedFS extension, not in AWS CLI)
+- **User deletion**: Deleting a user automatically removes them from all groups
+- **Policy deletion**: A policy cannot be deleted if it is attached to any group
+
+---
+
 ## Verify Configuration

 Check the current S3/IAM configuration:
@@ -70,6 +70,17 @@ weed iam -filer=localhost:8888 -port=8111
 | `AttachUserPolicy` | Attach managed policy to user | Admin only |
 | `DetachUserPolicy` | Remove managed policy from user | Admin only |
 | `ListAttachedUserPolicies` | List managed policies for user | Admin only |
+| `CreateGroup` | Create an IAM group | Admin only |
+| `DeleteGroup` | Delete an IAM group (must have no members or policies) | Admin only |
+| `GetGroup` | Get group details and members | Admin only |
+| `ListGroups` | List all groups | Admin only |
+| `AddUserToGroup` | Add a user to a group | Admin only |
+| `RemoveUserFromGroup` | Remove a user from a group | Admin only |
+| `AttachGroupPolicy` | Attach managed policy to group | Admin only |
+| `DetachGroupPolicy` | Remove managed policy from group | Admin only |
+| `ListAttachedGroupPolicies` | List managed policies for group | Admin only |
+| `ListGroupsForUser` | List groups a user belongs to | Admin only |
+| `UpdateGroup` | Rename or enable/disable a group (SeaweedFS extension) | Admin only |

 ### Self-Service Operations

@@ -268,6 +279,58 @@ Output:

 ---

+## Group Management
+
+IAM groups allow you to organize users and apply policies at the group level. Policies attached to a group apply to all members of that group.
+
+### Key Behaviors
+
+- **Authorization**: Group policies are evaluated alongside user policies during S3 request authorization
+- **Disabled groups**: A group can be disabled, which suspends its policies for all members without removing membership
+- **User deletion**: Deleting a user automatically removes them from all groups
+- **Policy deletion**: A policy cannot be deleted if it is attached to any group (must detach first)
+- **Group deletion**: A group must have no members and no attached policies before it can be deleted
+
+### Examples
+
+```bash
+# Create a group
+aws --endpoint $AWS_ENDPOINT iam create-group --group-name developers
+
+# Add user to group
+aws --endpoint $AWS_ENDPOINT iam add-user-to-group --group-name developers --user-name alice
+
+# Attach a managed policy to the group
+aws --endpoint $AWS_ENDPOINT iam attach-group-policy \
+  --group-name developers \
+  --policy-arn arn:aws:iam:::policy/ReadOnlyPolicy
+
+# List groups
+aws --endpoint $AWS_ENDPOINT iam list-groups
+
+# List group members
+aws --endpoint $AWS_ENDPOINT iam get-group --group-name developers
+
+# List policies attached to a group
+aws --endpoint $AWS_ENDPOINT iam list-attached-group-policies --group-name developers
+
+# List groups a user belongs to
+aws --endpoint $AWS_ENDPOINT iam list-groups-for-user --user-name alice
+
+# Remove user from group
+aws --endpoint $AWS_ENDPOINT iam remove-user-from-group --group-name developers --user-name alice
+
+# Detach policy from group
+aws --endpoint $AWS_ENDPOINT iam detach-group-policy \
+  --group-name developers \
+  --policy-arn arn:aws:iam:::policy/ReadOnlyPolicy
+
+# Delete group (must have no members or policies)
+aws --endpoint $AWS_ENDPOINT iam delete-group --group-name developers
+```
+
+---
+
 ## Configuration Storage

 IAM configurations are stored on the filer at `/etc/iam/identity.json`. Changes are automatically propagated to all S3 servers subscribed to filer metadata events.
@@ -22,6 +22,7 @@ This page compares the S3 API implementation in SeaweedFS with MinIO.
 | **Object Select** | ❌ No | ✅ Yes | `SelectObjectContent` |
 | **Object Attributes**| ✅ Yes | ✅ Yes | `GetObjectAttributes` |
 | **Lambda Triggers** | ❌ No | ✅ Yes | `GetObjectLambda` |
+| **IAM Groups** | ✅ Full | ⚠️ Proprietary | Similar group admin capability, but not API-compatible: SeaweedFS uses AWS IAM actions; MinIO uses proprietary `/minio/admin/v3` endpoints. |
 | **STS** | ✅ Partial | ✅ Full | SeaweedFS: standard AssumeRole APIs. MinIO: several extensions. |

 ## Implemented APIs (Both)
@@ -81,3 +82,43 @@ This page compares the S3 API implementation in SeaweedFS with MinIO.
 | `s3:GetBucketTagging` | ✅ | ✅ |
 | `s3:PutBucketOwnershipControls` | ✅ | ❌ (Rejected) |
 | `s3:GetPublicAccessBlock` | ✅ | ❌ (Rejected) |
+
+## IAM API Comparison
+
+SeaweedFS implements IAM actions as standard AWS IAM API calls (same endpoint as S3). MinIO uses a proprietary admin API (`/minio/admin/v3/`) accessible via `mc admin` CLI and `madmin-go` SDK.
+
+For group management specifically, MinIO supports broadly similar administration features, but not the same API surface. Group creation and deletion are implicit in MinIO's member-management flow, `ListGroupsForUser` is surfaced via user info (`MemberOf`) rather than a dedicated API, `ListAttachedGroupPolicies` is folded into broader admin responses, and SeaweedFS `UpdateGroup` rename support has no MinIO equivalent.
+
+| IAM Action | SeaweedFS | MinIO | Notes |
+| :--- | :---: | :---: | :--- |
+| `iam:CreateUser` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user add` |
+| `iam:DeleteUser` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user remove` |
+| `iam:GetUser` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user info` |
+| `iam:ListUsers` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user list` |
+| `iam:UpdateUser` | ✅ | ⚠️ Proprietary | |
+| `iam:SetUserStatus` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user enable/disable` |
+| `iam:CreateAccessKey` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user svcacct add` |
+| `iam:DeleteAccessKey` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user svcacct rm` |
+| `iam:ListAccessKeys` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user svcacct ls` |
+| `iam:UpdateAccessKey` | ✅ | ⚠️ Proprietary | |
+| `iam:CreatePolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy create` |
+| `iam:DeletePolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy rm` |
+| `iam:ListPolicies` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy ls` |
+| `iam:GetPolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy info` |
+| `iam:PutUserPolicy` | ✅ | ❌ | MinIO has no inline policy concept |
+| `iam:GetUserPolicy` | ✅ | ❌ | |
+| `iam:DeleteUserPolicy` | ✅ | ❌ | |
+| `iam:AttachUserPolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy attach` |
+| `iam:DetachUserPolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy detach` |
+| `iam:ListAttachedUserPolicies` | ✅ | ⚠️ Proprietary | |
+| `iam:CreateGroup` | ✅ | ⚠️ Proprietary | MinIO: implicit create via `mc admin group add` / `update-group-members`; no AWS IAM `CreateGroup` action |
+| `iam:DeleteGroup` | ✅ | ⚠️ Proprietary | MinIO: remove empty group via `mc admin group remove`; no AWS IAM `DeleteGroup` action |
+| `iam:GetGroup` | ✅ | ⚠️ Proprietary | MinIO: `mc admin group info` |
+| `iam:ListGroups` | ✅ | ⚠️ Proprietary | MinIO: `mc admin group list` |
+| `iam:AddUserToGroup` | ✅ | ⚠️ Proprietary | MinIO: `mc admin group add <group> <user>` |
+| `iam:RemoveUserFromGroup` | ✅ | ⚠️ Proprietary | MinIO: `mc admin group remove <group> <user>` |
+| `iam:AttachGroupPolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy attach --group` |
+| `iam:DetachGroupPolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy detach --group` |
+| `iam:ListAttachedGroupPolicies` | ✅ | ⚠️ Proprietary | No dedicated MinIO API; exposed via group info / policy mapping queries |
+| `iam:ListGroupsForUser` | ✅ | ⚠️ Proprietary | No dedicated MinIO API; returned as `MemberOf` in user info |
+| `iam:UpdateGroup` | ✅ | ⚠️ Partial | SeaweedFS extension: rename or enable/disable. MinIO only supports enable/disable via `set-group-status` |