From c16a4d99ce0aaf7974b4c6287e08b70418c6435c Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Tue, 10 Mar 2026 14:19:43 -0700 Subject: [PATCH] update wiki for iam groups --- AWS-IAM-CLI.md | 88 ++++++++++++++++++++++++++++++++++++++ Amazon-IAM-API.md | 63 +++++++++++++++++++++++++++ Supported-APIs-vs-Minio.md | 41 ++++++++++++++++++ 3 files changed, 192 insertions(+) diff --git a/AWS-IAM-CLI.md b/AWS-IAM-CLI.md index 586dc8d..9758583 100644 --- a/AWS-IAM-CLI.md +++ b/AWS-IAM-CLI.md @@ -333,6 +333,94 @@ aws --endpoint $AWS_ENDPOINT iam delete-policy \ --- +## Group Management + +Groups allow you to organize users and apply policies at the group level. Policies attached to a group are evaluated for all group members during S3 authorization. + +### Create a Group + +```bash +aws --endpoint $AWS_ENDPOINT iam create-group --group-name developers +``` + +Output: +```json +{ + "Group": { + "GroupName": "developers" + } +} +``` + +### List Groups + +```bash +aws --endpoint $AWS_ENDPOINT iam list-groups +``` + +### Get Group Details (including members) + +```bash +aws --endpoint $AWS_ENDPOINT iam get-group --group-name developers +``` + +### Add User to Group + +```bash +aws --endpoint $AWS_ENDPOINT iam add-user-to-group --group-name developers --user-name bob +``` + +### Remove User from Group + +```bash +aws --endpoint $AWS_ENDPOINT iam remove-user-from-group --group-name developers --user-name bob +``` + +### Attach Policy to Group + +```bash +aws --endpoint $AWS_ENDPOINT iam attach-group-policy \ + --group-name developers \ + --policy-arn arn:aws:iam:::policy/ReadOnlyPolicy +``` + +### List Policies Attached to Group + +```bash +aws --endpoint $AWS_ENDPOINT iam list-attached-group-policies --group-name developers +``` + +### Detach Policy from Group + +```bash +aws --endpoint $AWS_ENDPOINT iam detach-group-policy \ + --group-name developers \ + --policy-arn arn:aws:iam:::policy/ReadOnlyPolicy +``` + +### List Groups for a User + +```bash +aws --endpoint $AWS_ENDPOINT iam list-groups-for-user --user-name bob +``` + +### Delete a Group + +> **Note**: A group must have no members and no attached policies before it can be deleted. + +```bash +aws --endpoint $AWS_ENDPOINT iam delete-group --group-name developers +``` + +### Key Behaviors + +- **Group policies**: Policies attached to a group apply to all members during S3 authorization +- **Disabled groups**: Groups can be disabled/enabled (SeaweedFS extension, not in AWS CLI) +- **User deletion**: Deleting a user automatically removes them from all groups +- **Policy deletion**: A policy cannot be deleted if it is attached to any group + +--- + ## Verify Configuration Check the current S3/IAM configuration: diff --git a/Amazon-IAM-API.md b/Amazon-IAM-API.md index 780b37f..e743d3d 100644 --- a/Amazon-IAM-API.md +++ b/Amazon-IAM-API.md @@ -70,6 +70,17 @@ weed iam -filer=localhost:8888 -port=8111 | `AttachUserPolicy` | Attach managed policy to user | Admin only | | `DetachUserPolicy` | Remove managed policy from user | Admin only | | `ListAttachedUserPolicies` | List managed policies for user | Admin only | +| `CreateGroup` | Create an IAM group | Admin only | +| `DeleteGroup` | Delete an IAM group (must have no members or policies) | Admin only | +| `GetGroup` | Get group details and members | Admin only | +| `ListGroups` | List all groups | Admin only | +| `AddUserToGroup` | Add a user to a group | Admin only | +| `RemoveUserFromGroup` | Remove a user from a group | Admin only | +| `AttachGroupPolicy` | Attach managed policy to group | Admin only | +| `DetachGroupPolicy` | Remove managed policy from group | Admin only | +| `ListAttachedGroupPolicies` | List managed policies for group | Admin only | +| `ListGroupsForUser` | List groups a user belongs to | Admin only | +| `UpdateGroup` | Rename or enable/disable a group (SeaweedFS extension) | Admin only | ### Self-Service Operations @@ -268,6 +279,58 @@ Output: --- +## Group Management + +IAM groups allow you to organize users and apply policies at the group level. Policies attached to a group apply to all members of that group. + +### Key Behaviors + +- **Authorization**: Group policies are evaluated alongside user policies during S3 request authorization +- **Disabled groups**: A group can be disabled, which suspends its policies for all members without removing membership +- **User deletion**: Deleting a user automatically removes them from all groups +- **Policy deletion**: A policy cannot be deleted if it is attached to any group (must detach first) +- **Group deletion**: A group must have no members and no attached policies before it can be deleted + +### Examples + +```bash +# Create a group +aws --endpoint $AWS_ENDPOINT iam create-group --group-name developers + +# Add user to group +aws --endpoint $AWS_ENDPOINT iam add-user-to-group --group-name developers --user-name alice + +# Attach a managed policy to the group +aws --endpoint $AWS_ENDPOINT iam attach-group-policy \ + --group-name developers \ + --policy-arn arn:aws:iam:::policy/ReadOnlyPolicy + +# List groups +aws --endpoint $AWS_ENDPOINT iam list-groups + +# List group members +aws --endpoint $AWS_ENDPOINT iam get-group --group-name developers + +# List policies attached to a group +aws --endpoint $AWS_ENDPOINT iam list-attached-group-policies --group-name developers + +# List groups a user belongs to +aws --endpoint $AWS_ENDPOINT iam list-groups-for-user --user-name alice + +# Remove user from group +aws --endpoint $AWS_ENDPOINT iam remove-user-from-group --group-name developers --user-name alice + +# Detach policy from group +aws --endpoint $AWS_ENDPOINT iam detach-group-policy \ + --group-name developers \ + --policy-arn arn:aws:iam:::policy/ReadOnlyPolicy + +# Delete group (must have no members or policies) +aws --endpoint $AWS_ENDPOINT iam delete-group --group-name developers +``` + +--- + ## Configuration Storage IAM configurations are stored on the filer at `/etc/iam/identity.json`. Changes are automatically propagated to all S3 servers subscribed to filer metadata events. diff --git a/Supported-APIs-vs-Minio.md b/Supported-APIs-vs-Minio.md index f8e7c5f..6bcaad7 100644 --- a/Supported-APIs-vs-Minio.md +++ b/Supported-APIs-vs-Minio.md @@ -22,6 +22,7 @@ This page compares the S3 API implementation in SeaweedFS with MinIO. | **Object Select** | ❌ No | ✅ Yes | `SelectObjectContent` | | **Object Attributes**| ✅ Yes | ✅ Yes | `GetObjectAttributes` | | **Lambda Triggers** | ❌ No | ✅ Yes | `GetObjectLambda` | +| **IAM Groups** | ✅ Full | ⚠️ Proprietary | Similar group admin capability, but not API-compatible: SeaweedFS uses AWS IAM actions; MinIO uses proprietary `/minio/admin/v3` endpoints. | | **STS** | ✅ Partial | ✅ Full | SeaweedFS: standard AssumeRole APIs. MinIO: several extensions. | ## Implemented APIs (Both) @@ -81,3 +82,43 @@ This page compares the S3 API implementation in SeaweedFS with MinIO. | `s3:GetBucketTagging` | ✅ | ✅ | | `s3:PutBucketOwnershipControls` | ✅ | ❌ (Rejected) | | `s3:GetPublicAccessBlock` | ✅ | ❌ (Rejected) | + +## IAM API Comparison + +SeaweedFS implements IAM actions as standard AWS IAM API calls (same endpoint as S3). MinIO uses a proprietary admin API (`/minio/admin/v3/`) accessible via `mc admin` CLI and `madmin-go` SDK. + +For group management specifically, MinIO supports broadly similar administration features, but not the same API surface. Group creation and deletion are implicit in MinIO's member-management flow, `ListGroupsForUser` is surfaced via user info (`MemberOf`) rather than a dedicated API, `ListAttachedGroupPolicies` is folded into broader admin responses, and SeaweedFS `UpdateGroup` rename support has no MinIO equivalent. + +| IAM Action | SeaweedFS | MinIO | Notes | +| :--- | :---: | :---: | :--- | +| `iam:CreateUser` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user add` | +| `iam:DeleteUser` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user remove` | +| `iam:GetUser` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user info` | +| `iam:ListUsers` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user list` | +| `iam:UpdateUser` | ✅ | ⚠️ Proprietary | | +| `iam:SetUserStatus` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user enable/disable` | +| `iam:CreateAccessKey` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user svcacct add` | +| `iam:DeleteAccessKey` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user svcacct rm` | +| `iam:ListAccessKeys` | ✅ | ⚠️ Proprietary | MinIO: `mc admin user svcacct ls` | +| `iam:UpdateAccessKey` | ✅ | ⚠️ Proprietary | | +| `iam:CreatePolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy create` | +| `iam:DeletePolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy rm` | +| `iam:ListPolicies` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy ls` | +| `iam:GetPolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy info` | +| `iam:PutUserPolicy` | ✅ | ❌ | MinIO has no inline policy concept | +| `iam:GetUserPolicy` | ✅ | ❌ | | +| `iam:DeleteUserPolicy` | ✅ | ❌ | | +| `iam:AttachUserPolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy attach` | +| `iam:DetachUserPolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy detach` | +| `iam:ListAttachedUserPolicies` | ✅ | ⚠️ Proprietary | | +| `iam:CreateGroup` | ✅ | ⚠️ Proprietary | MinIO: implicit create via `mc admin group add` / `update-group-members`; no AWS IAM `CreateGroup` action | +| `iam:DeleteGroup` | ✅ | ⚠️ Proprietary | MinIO: remove empty group via `mc admin group remove`; no AWS IAM `DeleteGroup` action | +| `iam:GetGroup` | ✅ | ⚠️ Proprietary | MinIO: `mc admin group info` | +| `iam:ListGroups` | ✅ | ⚠️ Proprietary | MinIO: `mc admin group list` | +| `iam:AddUserToGroup` | ✅ | ⚠️ Proprietary | MinIO: `mc admin group add ` | +| `iam:RemoveUserFromGroup` | ✅ | ⚠️ Proprietary | MinIO: `mc admin group remove ` | +| `iam:AttachGroupPolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy attach --group` | +| `iam:DetachGroupPolicy` | ✅ | ⚠️ Proprietary | MinIO: `mc admin policy detach --group` | +| `iam:ListAttachedGroupPolicies` | ✅ | ⚠️ Proprietary | No dedicated MinIO API; exposed via group info / policy mapping queries | +| `iam:ListGroupsForUser` | ✅ | ⚠️ Proprietary | No dedicated MinIO API; returned as `MemberOf` in user info | +| `iam:UpdateGroup` | ✅ | ⚠️ Partial | SeaweedFS extension: rename or enable/disable. MinIO only supports enable/disable via `set-group-status` |