tam-i13
3 weeks ago
committed by
GitHub
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
17 changed files with 1741 additions and 304 deletions
-
9weed/s3api/auth_credentials.go
-
239weed/s3api/policy_conversion.go
-
614weed/s3api/policy_conversion_test.go
-
334weed/s3api/s3_action_resolver.go
-
84weed/s3api/s3_constants/s3_action_strings.go
-
316weed/s3api/s3_granular_action_security_test.go
-
173weed/s3api/s3_iam_middleware.go
-
6weed/s3api/s3_iam_simple_test.go
-
48weed/s3api/s3_list_parts_action_test.go
-
4weed/s3api/s3_multipart_iam_test.go
-
3weed/s3api/s3api_bucket_handlers.go
-
138weed/s3api/s3api_bucket_policy_engine.go
-
9weed/s3api/s3api_object_handlers_put.go
-
12weed/s3api/s3api_server.go
-
6weed/server/volume_server_handlers.go
-
10weed/server/volume_server_handlers_read.go
-
38weed/shell/command_volume_check_disk.go
@ -0,0 +1,239 @@ |
|||
package s3api |
|||
|
|||
import ( |
|||
"fmt" |
|||
|
|||
"github.com/seaweedfs/seaweedfs/weed/glog" |
|||
"github.com/seaweedfs/seaweedfs/weed/iam/policy" |
|||
"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine" |
|||
) |
|||
|
|||
// ConvertPolicyDocumentToPolicyEngine converts a policy.PolicyDocument to policy_engine.PolicyDocument
|
|||
// This function provides type-safe conversion with explicit field mapping and error handling.
|
|||
// It handles the differences between the two types:
|
|||
// - Converts []string fields to StringOrStringSlice
|
|||
// - Maps Condition types with type validation
|
|||
// - Converts Principal fields with support for AWS principals only
|
|||
// - Handles optional fields (Id, NotPrincipal, NotAction, NotResource are ignored in policy_engine)
|
|||
//
|
|||
// Returns an error if the policy contains unsupported types or malformed data.
|
|||
func ConvertPolicyDocumentToPolicyEngine(src *policy.PolicyDocument) (*policy_engine.PolicyDocument, error) { |
|||
if src == nil { |
|||
return nil, nil |
|||
} |
|||
|
|||
// Warn if the policy document Id is being dropped
|
|||
if src.Id != "" { |
|||
glog.Warningf("policy document Id %q is not supported and will be ignored", src.Id) |
|||
} |
|||
|
|||
dest := &policy_engine.PolicyDocument{ |
|||
Version: src.Version, |
|||
Statement: make([]policy_engine.PolicyStatement, len(src.Statement)), |
|||
} |
|||
|
|||
for i := range src.Statement { |
|||
stmt, err := convertStatement(&src.Statement[i]) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("failed to convert statement %d: %w", i, err) |
|||
} |
|||
dest.Statement[i] = stmt |
|||
} |
|||
|
|||
return dest, nil |
|||
} |
|||
|
|||
// convertStatement converts a policy.Statement to policy_engine.PolicyStatement
|
|||
func convertStatement(src *policy.Statement) (policy_engine.PolicyStatement, error) { |
|||
// Check for unsupported fields that would fundamentally change policy semantics
|
|||
// These fields invert the logic and ignoring them could create security holes
|
|||
if len(src.NotAction) > 0 { |
|||
return policy_engine.PolicyStatement{}, fmt.Errorf("statement %q: NotAction is not supported (would invert action logic, creating potential security risk)", src.Sid) |
|||
} |
|||
if len(src.NotResource) > 0 { |
|||
return policy_engine.PolicyStatement{}, fmt.Errorf("statement %q: NotResource is not supported (would invert resource logic, creating potential security risk)", src.Sid) |
|||
} |
|||
if src.NotPrincipal != nil { |
|||
return policy_engine.PolicyStatement{}, fmt.Errorf("statement %q: NotPrincipal is not supported (would invert principal logic, creating potential security risk)", src.Sid) |
|||
} |
|||
|
|||
stmt := policy_engine.PolicyStatement{ |
|||
Sid: src.Sid, |
|||
Effect: policy_engine.PolicyEffect(src.Effect), |
|||
} |
|||
|
|||
// Convert Action ([]string to StringOrStringSlice)
|
|||
if len(src.Action) > 0 { |
|||
stmt.Action = policy_engine.NewStringOrStringSlice(src.Action...) |
|||
} |
|||
|
|||
// Convert Resource ([]string to StringOrStringSlice)
|
|||
if len(src.Resource) > 0 { |
|||
stmt.Resource = policy_engine.NewStringOrStringSlice(src.Resource...) |
|||
} |
|||
|
|||
// Convert Principal (interface{} to *StringOrStringSlice)
|
|||
if src.Principal != nil { |
|||
principal, err := convertPrincipal(src.Principal) |
|||
if err != nil { |
|||
return policy_engine.PolicyStatement{}, fmt.Errorf("statement %q: failed to convert principal: %w", src.Sid, err) |
|||
} |
|||
stmt.Principal = principal |
|||
} |
|||
|
|||
// Convert Condition (map[string]map[string]interface{} to PolicyConditions)
|
|||
if len(src.Condition) > 0 { |
|||
condition, err := convertCondition(src.Condition) |
|||
if err != nil { |
|||
return policy_engine.PolicyStatement{}, fmt.Errorf("statement %q: failed to convert condition: %w", src.Sid, err) |
|||
} |
|||
stmt.Condition = condition |
|||
} |
|||
|
|||
return stmt, nil |
|||
} |
|||
|
|||
// convertPrincipal converts a Principal field to *StringOrStringSlice
|
|||
func convertPrincipal(principal interface{}) (*policy_engine.StringOrStringSlice, error) { |
|||
if principal == nil { |
|||
return nil, nil |
|||
} |
|||
|
|||
switch p := principal.(type) { |
|||
case string: |
|||
if p == "" { |
|||
return nil, fmt.Errorf("principal string cannot be empty") |
|||
} |
|||
result := policy_engine.NewStringOrStringSlice(p) |
|||
return &result, nil |
|||
case []string: |
|||
if len(p) == 0 { |
|||
return nil, nil |
|||
} |
|||
for _, s := range p { |
|||
if s == "" { |
|||
return nil, fmt.Errorf("principal string in slice cannot be empty") |
|||
} |
|||
} |
|||
result := policy_engine.NewStringOrStringSlice(p...) |
|||
return &result, nil |
|||
case []interface{}: |
|||
strs := make([]string, 0, len(p)) |
|||
for _, v := range p { |
|||
if v != nil { |
|||
str, err := convertToString(v) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("failed to convert principal array item: %w", err) |
|||
} |
|||
if str == "" { |
|||
return nil, fmt.Errorf("principal string in slice cannot be empty") |
|||
} |
|||
strs = append(strs, str) |
|||
} |
|||
} |
|||
if len(strs) == 0 { |
|||
return nil, nil |
|||
} |
|||
result := policy_engine.NewStringOrStringSlice(strs...) |
|||
return &result, nil |
|||
case map[string]interface{}: |
|||
// Handle AWS-style principal with service/user keys
|
|||
// Example: {"AWS": "arn:aws:iam::123456789012:user/Alice"}
|
|||
// Only AWS principals are supported for now. Other types like Service or Federated need special handling.
|
|||
|
|||
awsPrincipals, ok := p["AWS"] |
|||
if !ok || len(p) != 1 { |
|||
glog.Warningf("unsupported principal map, only a single 'AWS' key is supported: %v", p) |
|||
return nil, fmt.Errorf("unsupported principal map, only a single 'AWS' key is supported, got keys: %v", getMapKeys(p)) |
|||
} |
|||
|
|||
// Recursively convert the AWS principal value
|
|||
res, err := convertPrincipal(awsPrincipals) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("invalid 'AWS' principal value: %w", err) |
|||
} |
|||
return res, nil |
|||
default: |
|||
return nil, fmt.Errorf("unsupported principal type: %T", p) |
|||
} |
|||
} |
|||
|
|||
// convertCondition converts policy conditions to PolicyConditions
|
|||
func convertCondition(src map[string]map[string]interface{}) (policy_engine.PolicyConditions, error) { |
|||
if len(src) == 0 { |
|||
return nil, nil |
|||
} |
|||
|
|||
dest := make(policy_engine.PolicyConditions) |
|||
for condType, condBlock := range src { |
|||
destBlock := make(map[string]policy_engine.StringOrStringSlice) |
|||
for key, value := range condBlock { |
|||
condValue, err := convertConditionValue(value) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("failed to convert condition %s[%s]: %w", condType, key, err) |
|||
} |
|||
destBlock[key] = condValue |
|||
} |
|||
dest[condType] = destBlock |
|||
} |
|||
|
|||
return dest, nil |
|||
} |
|||
|
|||
// convertConditionValue converts a condition value to StringOrStringSlice
|
|||
func convertConditionValue(value interface{}) (policy_engine.StringOrStringSlice, error) { |
|||
switch v := value.(type) { |
|||
case string: |
|||
return policy_engine.NewStringOrStringSlice(v), nil |
|||
case []string: |
|||
return policy_engine.NewStringOrStringSlice(v...), nil |
|||
case []interface{}: |
|||
strs := make([]string, 0, len(v)) |
|||
for _, item := range v { |
|||
if item != nil { |
|||
str, err := convertToString(item) |
|||
if err != nil { |
|||
return policy_engine.StringOrStringSlice{}, fmt.Errorf("failed to convert condition array item: %w", err) |
|||
} |
|||
strs = append(strs, str) |
|||
} |
|||
} |
|||
return policy_engine.NewStringOrStringSlice(strs...), nil |
|||
default: |
|||
// For non-string types, convert to string
|
|||
// This handles numbers, booleans, etc.
|
|||
str, err := convertToString(v) |
|||
if err != nil { |
|||
return policy_engine.StringOrStringSlice{}, err |
|||
} |
|||
return policy_engine.NewStringOrStringSlice(str), nil |
|||
} |
|||
} |
|||
|
|||
// convertToString converts any value to string representation
|
|||
// Returns an error for unsupported types to prevent silent data corruption
|
|||
func convertToString(value interface{}) (string, error) { |
|||
switch v := value.(type) { |
|||
case string: |
|||
return v, nil |
|||
case bool, |
|||
int, int8, int16, int32, int64, |
|||
uint, uint8, uint16, uint32, uint64, |
|||
float32, float64: |
|||
// Use fmt.Sprint for supported primitive types
|
|||
return fmt.Sprint(v), nil |
|||
default: |
|||
glog.Warningf("unsupported type in policy conversion: %T", v) |
|||
return "", fmt.Errorf("unsupported type in policy conversion: %T", v) |
|||
} |
|||
} |
|||
|
|||
// getMapKeys returns the keys of a map as a slice (helper for error messages)
|
|||
func getMapKeys(m map[string]interface{}) []string { |
|||
keys := make([]string, 0, len(m)) |
|||
for k := range m { |
|||
keys = append(keys, k) |
|||
} |
|||
return keys |
|||
} |
|||
|
|||
@ -0,0 +1,614 @@ |
|||
package s3api |
|||
|
|||
import ( |
|||
"strings" |
|||
"testing" |
|||
|
|||
"github.com/seaweedfs/seaweedfs/weed/iam/policy" |
|||
) |
|||
|
|||
func TestConvertPolicyDocumentWithMixedTypes(t *testing.T) { |
|||
// Test that numeric and boolean values in arrays are properly converted
|
|||
src := &policy.PolicyDocument{ |
|||
Version: "2012-10-17", |
|||
Statement: []policy.Statement{ |
|||
{ |
|||
Sid: "TestMixedTypes", |
|||
Effect: "Allow", |
|||
Action: []string{"s3:GetObject"}, |
|||
Resource: []string{"arn:aws:s3:::bucket/*"}, |
|||
Principal: []interface{}{"user1", 123, true}, // Mixed types
|
|||
Condition: map[string]map[string]interface{}{ |
|||
"NumericEquals": { |
|||
"s3:max-keys": []interface{}{100, 200, "300"}, // Mixed types
|
|||
}, |
|||
"StringEquals": { |
|||
"s3:prefix": []interface{}{"test", 123, false}, // Mixed types
|
|||
}, |
|||
}, |
|||
}, |
|||
}, |
|||
} |
|||
|
|||
// Convert
|
|||
dest, err := ConvertPolicyDocumentToPolicyEngine(src) |
|||
if err != nil { |
|||
t.Fatalf("Unexpected error: %v", err) |
|||
} |
|||
|
|||
// Verify document structure
|
|||
if dest == nil { |
|||
t.Fatal("Expected non-nil result") |
|||
} |
|||
if dest.Version != "2012-10-17" { |
|||
t.Errorf("Expected version '2012-10-17', got '%s'", dest.Version) |
|||
} |
|||
if len(dest.Statement) != 1 { |
|||
t.Fatalf("Expected 1 statement, got %d", len(dest.Statement)) |
|||
} |
|||
|
|||
stmt := dest.Statement[0] |
|||
|
|||
// Verify Principal conversion (should have 3 items converted to strings)
|
|||
if stmt.Principal == nil { |
|||
t.Fatal("Expected non-nil Principal") |
|||
} |
|||
principals := stmt.Principal.Strings() |
|||
if len(principals) != 3 { |
|||
t.Errorf("Expected 3 principals, got %d", len(principals)) |
|||
} |
|||
// Check that numeric and boolean were converted
|
|||
expectedPrincipals := []string{"user1", "123", "true"} |
|||
for i, expected := range expectedPrincipals { |
|||
if principals[i] != expected { |
|||
t.Errorf("Principal[%d]: expected '%s', got '%s'", i, expected, principals[i]) |
|||
} |
|||
} |
|||
|
|||
// Verify Condition conversion
|
|||
if len(stmt.Condition) != 2 { |
|||
t.Errorf("Expected 2 condition blocks, got %d", len(stmt.Condition)) |
|||
} |
|||
|
|||
// Check NumericEquals condition
|
|||
numericCond, ok := stmt.Condition["NumericEquals"] |
|||
if !ok { |
|||
t.Fatal("Expected NumericEquals condition") |
|||
} |
|||
maxKeys, ok := numericCond["s3:max-keys"] |
|||
if !ok { |
|||
t.Fatal("Expected s3:max-keys in NumericEquals") |
|||
} |
|||
maxKeysStrs := maxKeys.Strings() |
|||
expectedMaxKeys := []string{"100", "200", "300"} |
|||
if len(maxKeysStrs) != len(expectedMaxKeys) { |
|||
t.Errorf("Expected %d max-keys values, got %d", len(expectedMaxKeys), len(maxKeysStrs)) |
|||
} |
|||
for i, expected := range expectedMaxKeys { |
|||
if maxKeysStrs[i] != expected { |
|||
t.Errorf("max-keys[%d]: expected '%s', got '%s'", i, expected, maxKeysStrs[i]) |
|||
} |
|||
} |
|||
|
|||
// Check StringEquals condition
|
|||
stringCond, ok := stmt.Condition["StringEquals"] |
|||
if !ok { |
|||
t.Fatal("Expected StringEquals condition") |
|||
} |
|||
prefix, ok := stringCond["s3:prefix"] |
|||
if !ok { |
|||
t.Fatal("Expected s3:prefix in StringEquals") |
|||
} |
|||
prefixStrs := prefix.Strings() |
|||
expectedPrefix := []string{"test", "123", "false"} |
|||
if len(prefixStrs) != len(expectedPrefix) { |
|||
t.Errorf("Expected %d prefix values, got %d", len(expectedPrefix), len(prefixStrs)) |
|||
} |
|||
for i, expected := range expectedPrefix { |
|||
if prefixStrs[i] != expected { |
|||
t.Errorf("prefix[%d]: expected '%s', got '%s'", i, expected, prefixStrs[i]) |
|||
} |
|||
} |
|||
} |
|||
|
|||
func TestConvertPrincipalWithMapAndMixedTypes(t *testing.T) { |
|||
// Test AWS-style principal map with mixed types
|
|||
principalMap := map[string]interface{}{ |
|||
"AWS": []interface{}{ |
|||
"arn:aws:iam::123456789012:user/Alice", |
|||
456, // User ID as number
|
|||
true, // Some boolean value
|
|||
}, |
|||
} |
|||
|
|||
result, err := convertPrincipal(principalMap) |
|||
if err != nil { |
|||
t.Fatalf("Unexpected error: %v", err) |
|||
} |
|||
|
|||
if result == nil { |
|||
t.Fatal("Expected non-nil result") |
|||
} |
|||
|
|||
strs := result.Strings() |
|||
if len(strs) != 3 { |
|||
t.Errorf("Expected 3 values, got %d", len(strs)) |
|||
} |
|||
|
|||
expectedValues := []string{ |
|||
"arn:aws:iam::123456789012:user/Alice", |
|||
"456", |
|||
"true", |
|||
} |
|||
|
|||
for i, expected := range expectedValues { |
|||
if strs[i] != expected { |
|||
t.Errorf("Value[%d]: expected '%s', got '%s'", i, expected, strs[i]) |
|||
} |
|||
} |
|||
} |
|||
|
|||
func TestConvertConditionValueWithMixedTypes(t *testing.T) { |
|||
// Test []interface{} with mixed types
|
|||
mixedValues := []interface{}{ |
|||
"string", |
|||
123, |
|||
true, |
|||
456.78, |
|||
} |
|||
|
|||
result, err := convertConditionValue(mixedValues) |
|||
if err != nil { |
|||
t.Fatalf("Unexpected error: %v", err) |
|||
} |
|||
strs := result.Strings() |
|||
|
|||
expectedValues := []string{"string", "123", "true", "456.78"} |
|||
if len(strs) != len(expectedValues) { |
|||
t.Errorf("Expected %d values, got %d", len(expectedValues), len(strs)) |
|||
} |
|||
|
|||
for i, expected := range expectedValues { |
|||
if strs[i] != expected { |
|||
t.Errorf("Value[%d]: expected '%s', got '%s'", i, expected, strs[i]) |
|||
} |
|||
} |
|||
} |
|||
|
|||
func TestConvertPolicyDocumentNil(t *testing.T) { |
|||
result, err := ConvertPolicyDocumentToPolicyEngine(nil) |
|||
if err != nil { |
|||
t.Errorf("Unexpected error for nil input: %v", err) |
|||
} |
|||
if result != nil { |
|||
t.Error("Expected nil result for nil input") |
|||
} |
|||
} |
|||
|
|||
func TestConvertPrincipalNil(t *testing.T) { |
|||
result, err := convertPrincipal(nil) |
|||
if err != nil { |
|||
t.Errorf("Unexpected error for nil input: %v", err) |
|||
} |
|||
if result != nil { |
|||
t.Error("Expected nil result for nil input") |
|||
} |
|||
} |
|||
|
|||
func TestConvertPrincipalEmptyArray(t *testing.T) { |
|||
// Empty array should return nil
|
|||
result, err := convertPrincipal([]interface{}{}) |
|||
if err != nil { |
|||
t.Errorf("Unexpected error for empty array: %v", err) |
|||
} |
|||
if result != nil { |
|||
t.Error("Expected nil result for empty array") |
|||
} |
|||
} |
|||
|
|||
func TestConvertPrincipalUnknownType(t *testing.T) { |
|||
// Unknown types should return an error
|
|||
result, err := convertPrincipal(12345) // Just a number, not valid principal
|
|||
if err == nil { |
|||
t.Error("Expected error for unknown type") |
|||
} |
|||
if result != nil { |
|||
t.Error("Expected nil result for unknown type") |
|||
} |
|||
} |
|||
|
|||
func TestConvertPrincipalWithNilValues(t *testing.T) { |
|||
// Test that nil values in arrays are skipped for security
|
|||
principalArray := []interface{}{ |
|||
"arn:aws:iam::123456789012:user/Alice", |
|||
nil, // Should be skipped
|
|||
"arn:aws:iam::123456789012:user/Bob", |
|||
nil, // Should be skipped
|
|||
} |
|||
|
|||
result, err := convertPrincipal(principalArray) |
|||
if err != nil { |
|||
t.Fatalf("Unexpected error: %v", err) |
|||
} |
|||
|
|||
if result == nil { |
|||
t.Fatal("Expected non-nil result") |
|||
} |
|||
|
|||
strs := result.Strings() |
|||
// Should only have 2 values (nil values skipped)
|
|||
if len(strs) != 2 { |
|||
t.Errorf("Expected 2 values (nil values skipped), got %d", len(strs)) |
|||
} |
|||
|
|||
expectedValues := []string{ |
|||
"arn:aws:iam::123456789012:user/Alice", |
|||
"arn:aws:iam::123456789012:user/Bob", |
|||
} |
|||
|
|||
for i, expected := range expectedValues { |
|||
if strs[i] != expected { |
|||
t.Errorf("Value[%d]: expected '%s', got '%s'", i, expected, strs[i]) |
|||
} |
|||
} |
|||
} |
|||
|
|||
func TestConvertConditionValueWithNilValues(t *testing.T) { |
|||
// Test that nil values in condition arrays are skipped
|
|||
mixedValues := []interface{}{ |
|||
"string", |
|||
nil, // Should be skipped
|
|||
123, |
|||
nil, // Should be skipped
|
|||
true, |
|||
} |
|||
|
|||
result, err := convertConditionValue(mixedValues) |
|||
if err != nil { |
|||
t.Fatalf("Unexpected error: %v", err) |
|||
} |
|||
strs := result.Strings() |
|||
|
|||
// Should only have 3 values (nil values skipped)
|
|||
expectedValues := []string{"string", "123", "true"} |
|||
if len(strs) != len(expectedValues) { |
|||
t.Errorf("Expected %d values (nil values skipped), got %d", len(expectedValues), len(strs)) |
|||
} |
|||
|
|||
for i, expected := range expectedValues { |
|||
if strs[i] != expected { |
|||
t.Errorf("Value[%d]: expected '%s', got '%s'", i, expected, strs[i]) |
|||
} |
|||
} |
|||
} |
|||
|
|||
func TestConvertPrincipalMapWithNilValues(t *testing.T) { |
|||
// Test AWS-style principal map with nil values
|
|||
principalMap := map[string]interface{}{ |
|||
"AWS": []interface{}{ |
|||
"arn:aws:iam::123456789012:user/Alice", |
|||
nil, // Should be skipped
|
|||
"arn:aws:iam::123456789012:user/Bob", |
|||
}, |
|||
} |
|||
|
|||
result, err := convertPrincipal(principalMap) |
|||
if err != nil { |
|||
t.Fatalf("Unexpected error: %v", err) |
|||
} |
|||
|
|||
if result == nil { |
|||
t.Fatal("Expected non-nil result") |
|||
} |
|||
|
|||
strs := result.Strings() |
|||
// Should only have 2 values (nil value skipped)
|
|||
if len(strs) != 2 { |
|||
t.Errorf("Expected 2 values (nil value skipped), got %d", len(strs)) |
|||
} |
|||
|
|||
expectedValues := []string{ |
|||
"arn:aws:iam::123456789012:user/Alice", |
|||
"arn:aws:iam::123456789012:user/Bob", |
|||
} |
|||
|
|||
for i, expected := range expectedValues { |
|||
if strs[i] != expected { |
|||
t.Errorf("Value[%d]: expected '%s', got '%s'", i, expected, strs[i]) |
|||
} |
|||
} |
|||
} |
|||
|
|||
func TestConvertToStringUnsupportedType(t *testing.T) { |
|||
// Test that unsupported types (e.g., nested maps/slices) return empty string
|
|||
// This should trigger a warning log and return an error
|
|||
|
|||
type customStruct struct { |
|||
Field string |
|||
} |
|||
|
|||
testCases := []struct { |
|||
name string |
|||
input interface{} |
|||
expected string |
|||
}{ |
|||
{ |
|||
name: "nested map", |
|||
input: map[string]interface{}{"key": "value"}, |
|||
expected: "", // Unsupported, returns empty string
|
|||
}, |
|||
{ |
|||
name: "nested slice", |
|||
input: []int{1, 2, 3}, |
|||
expected: "", // Unsupported, returns empty string
|
|||
}, |
|||
{ |
|||
name: "custom struct", |
|||
input: customStruct{Field: "test"}, |
|||
expected: "", // Unsupported, returns empty string
|
|||
}, |
|||
{ |
|||
name: "function", |
|||
input: func() {}, |
|||
expected: "", // Unsupported, returns empty string
|
|||
}, |
|||
} |
|||
|
|||
for _, tc := range testCases { |
|||
t.Run(tc.name, func(t *testing.T) { |
|||
result, err := convertToString(tc.input) |
|||
// For unsupported types, we expect an error
|
|||
if err == nil { |
|||
t.Error("Expected error for unsupported type") |
|||
} |
|||
if result != tc.expected { |
|||
t.Errorf("Expected '%s', got '%s'", tc.expected, result) |
|||
} |
|||
}) |
|||
} |
|||
} |
|||
|
|||
func TestConvertToStringSupportedTypes(t *testing.T) { |
|||
// Test that all supported types convert correctly
|
|||
testCases := []struct { |
|||
name string |
|||
input interface{} |
|||
expected string |
|||
}{ |
|||
{"string", "test", "test"}, |
|||
{"bool true", true, "true"}, |
|||
{"bool false", false, "false"}, |
|||
{"int", 123, "123"}, |
|||
{"int8", int8(127), "127"}, |
|||
{"int16", int16(32767), "32767"}, |
|||
{"int32", int32(2147483647), "2147483647"}, |
|||
{"int64", int64(9223372036854775807), "9223372036854775807"}, |
|||
{"uint", uint(123), "123"}, |
|||
{"uint8", uint8(255), "255"}, |
|||
{"uint16", uint16(65535), "65535"}, |
|||
{"uint32", uint32(4294967295), "4294967295"}, |
|||
{"uint64", uint64(18446744073709551615), "18446744073709551615"}, |
|||
{"float32", float32(3.14), "3.14"}, |
|||
{"float64", float64(3.14159265359), "3.14159265359"}, |
|||
} |
|||
|
|||
for _, tc := range testCases { |
|||
t.Run(tc.name, func(t *testing.T) { |
|||
result, err := convertToString(tc.input) |
|||
if err != nil { |
|||
t.Errorf("Unexpected error for supported type %s: %v", tc.name, err) |
|||
} |
|||
if result != tc.expected { |
|||
t.Errorf("Expected '%s', got '%s'", tc.expected, result) |
|||
} |
|||
}) |
|||
} |
|||
} |
|||
|
|||
func TestConvertPrincipalUnsupportedTypes(t *testing.T) { |
|||
// Test that unsupported principal types return errors
|
|||
testCases := []struct { |
|||
name string |
|||
principal interface{} |
|||
}{ |
|||
{ |
|||
name: "Service principal", |
|||
principal: map[string]interface{}{"Service": "s3.amazonaws.com"}, |
|||
}, |
|||
{ |
|||
name: "Federated principal", |
|||
principal: map[string]interface{}{"Federated": "arn:aws:iam::123456789012:saml-provider/ExampleProvider"}, |
|||
}, |
|||
{ |
|||
name: "Multiple keys", |
|||
principal: map[string]interface{}{"AWS": "arn:...", "Service": "s3.amazonaws.com"}, |
|||
}, |
|||
} |
|||
|
|||
for _, tc := range testCases { |
|||
t.Run(tc.name, func(t *testing.T) { |
|||
result, err := convertPrincipal(tc.principal) |
|||
if err == nil { |
|||
t.Error("Expected error for unsupported principal type") |
|||
} |
|||
if result != nil { |
|||
t.Error("Expected nil result for unsupported principal type") |
|||
} |
|||
}) |
|||
} |
|||
} |
|||
|
|||
func TestConvertPrincipalEmptyStrings(t *testing.T) { |
|||
// Test that empty string principals are rejected for security
|
|||
testCases := []struct { |
|||
name string |
|||
principal interface{} |
|||
wantError string |
|||
}{ |
|||
{ |
|||
name: "Empty string principal", |
|||
principal: "", |
|||
wantError: "principal string cannot be empty", |
|||
}, |
|||
{ |
|||
name: "Empty string in array", |
|||
principal: []string{"arn:aws:iam::123456789012:user/Alice", "", "arn:aws:iam::123456789012:user/Bob"}, |
|||
wantError: "principal string in slice cannot be empty", |
|||
}, |
|||
{ |
|||
name: "Empty string in interface array", |
|||
principal: []interface{}{"arn:aws:iam::123456789012:user/Alice", ""}, |
|||
wantError: "principal string in slice cannot be empty", |
|||
}, |
|||
{ |
|||
name: "Empty string in AWS map", |
|||
principal: map[string]interface{}{ |
|||
"AWS": "", |
|||
}, |
|||
wantError: "principal string cannot be empty", |
|||
}, |
|||
{ |
|||
name: "Empty string in AWS map array", |
|||
principal: map[string]interface{}{ |
|||
"AWS": []string{"arn:aws:iam::123456789012:user/Alice", ""}, |
|||
}, |
|||
wantError: "principal string in slice cannot be empty", |
|||
}, |
|||
} |
|||
|
|||
for _, tc := range testCases { |
|||
t.Run(tc.name, func(t *testing.T) { |
|||
result, err := convertPrincipal(tc.principal) |
|||
if err == nil { |
|||
t.Error("Expected error for empty principal string") |
|||
} else if !strings.Contains(err.Error(), tc.wantError) { |
|||
t.Errorf("Expected error containing %q, got: %v", tc.wantError, err) |
|||
} |
|||
if result != nil { |
|||
t.Error("Expected nil result for empty principal string") |
|||
} |
|||
}) |
|||
} |
|||
} |
|||
|
|||
func TestConvertStatementWithUnsupportedFields(t *testing.T) { |
|||
// Test that errors are returned for unsupported fields
|
|||
// These fields are critical for policy semantics and ignoring them would be a security risk
|
|||
|
|||
testCases := []struct { |
|||
name string |
|||
statement *policy.Statement |
|||
wantError string |
|||
}{ |
|||
{ |
|||
name: "NotAction field", |
|||
statement: &policy.Statement{ |
|||
Sid: "TestNotAction", |
|||
Effect: "Deny", |
|||
Action: []string{"s3:GetObject"}, |
|||
NotAction: []string{"s3:PutObject", "s3:DeleteObject"}, |
|||
Resource: []string{"arn:aws:s3:::bucket/*"}, |
|||
}, |
|||
wantError: "NotAction is not supported", |
|||
}, |
|||
{ |
|||
name: "NotResource field", |
|||
statement: &policy.Statement{ |
|||
Sid: "TestNotResource", |
|||
Effect: "Allow", |
|||
Action: []string{"s3:*"}, |
|||
Resource: []string{"arn:aws:s3:::bucket/*"}, |
|||
NotResource: []string{"arn:aws:s3:::bucket/secret/*"}, |
|||
}, |
|||
wantError: "NotResource is not supported", |
|||
}, |
|||
{ |
|||
name: "NotPrincipal field", |
|||
statement: &policy.Statement{ |
|||
Sid: "TestNotPrincipal", |
|||
Effect: "Deny", |
|||
Action: []string{"s3:*"}, |
|||
Resource: []string{"arn:aws:s3:::bucket/*"}, |
|||
NotPrincipal: map[string]interface{}{"AWS": "arn:aws:iam::123456789012:user/Admin"}, |
|||
}, |
|||
wantError: "NotPrincipal is not supported", |
|||
}, |
|||
} |
|||
|
|||
for _, tc := range testCases { |
|||
t.Run(tc.name, func(t *testing.T) { |
|||
// The conversion should fail with an error for security reasons
|
|||
result, err := convertStatement(tc.statement) |
|||
if err == nil { |
|||
t.Error("Expected error for unsupported field, got nil") |
|||
} else if !strings.Contains(err.Error(), tc.wantError) { |
|||
t.Errorf("Expected error containing %q, got: %v", tc.wantError, err) |
|||
} |
|||
|
|||
// Verify zero-value struct is returned on error
|
|||
if result.Sid != "" || result.Effect != "" { |
|||
t.Error("Expected zero-value struct on error") |
|||
} |
|||
}) |
|||
} |
|||
} |
|||
|
|||
func TestConvertStatementSuccess(t *testing.T) { |
|||
// Test successful conversion without unsupported fields
|
|||
statement := &policy.Statement{ |
|||
Sid: "AllowGetObject", |
|||
Effect: "Allow", |
|||
Action: []string{"s3:GetObject"}, |
|||
Resource: []string{"arn:aws:s3:::bucket/*"}, |
|||
Principal: map[string]interface{}{ |
|||
"AWS": "arn:aws:iam::123456789012:user/Alice", |
|||
}, |
|||
} |
|||
|
|||
result, err := convertStatement(statement) |
|||
if err != nil { |
|||
t.Fatalf("Unexpected error: %v", err) |
|||
} |
|||
|
|||
if result.Sid != statement.Sid { |
|||
t.Errorf("Expected Sid %q, got %q", statement.Sid, result.Sid) |
|||
} |
|||
if string(result.Effect) != statement.Effect { |
|||
t.Errorf("Expected Effect %q, got %q", statement.Effect, result.Effect) |
|||
} |
|||
} |
|||
|
|||
func TestConvertPolicyDocumentWithId(t *testing.T) { |
|||
// Test that policy document Id field triggers a warning
|
|||
src := &policy.PolicyDocument{ |
|||
Version: "2012-10-17", |
|||
Id: "MyPolicyId", |
|||
Statement: []policy.Statement{ |
|||
{ |
|||
Sid: "AllowGetObject", |
|||
Effect: "Allow", |
|||
Action: []string{"s3:GetObject"}, |
|||
Resource: []string{"arn:aws:s3:::bucket/*"}, |
|||
}, |
|||
}, |
|||
} |
|||
|
|||
// The conversion should succeed but log a warning about Id
|
|||
dest, err := ConvertPolicyDocumentToPolicyEngine(src) |
|||
if err != nil { |
|||
t.Fatalf("Unexpected error: %v", err) |
|||
} |
|||
|
|||
if dest == nil { |
|||
t.Fatal("Expected non-nil result") |
|||
} |
|||
|
|||
// Verify basic conversion worked
|
|||
if dest.Version != src.Version { |
|||
t.Errorf("Expected Version %q, got %q", src.Version, dest.Version) |
|||
} |
|||
if len(dest.Statement) != 1 { |
|||
t.Errorf("Expected 1 statement, got %d", len(dest.Statement)) |
|||
} |
|||
} |
|||
|
|||
@ -0,0 +1,334 @@ |
|||
package s3api |
|||
|
|||
import ( |
|||
"net/http" |
|||
"net/url" |
|||
"strings" |
|||
|
|||
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants" |
|||
) |
|||
|
|||
// ResolveS3Action determines the specific S3 action from HTTP request context.
|
|||
// This is the unified implementation used by both the bucket policy engine
|
|||
// and the IAM integration for consistent action resolution.
|
|||
//
|
|||
// It examines the HTTP method, path, query parameters, and headers to determine
|
|||
// the most specific S3 action string (e.g., "s3:DeleteObject", "s3:PutObjectTagging").
|
|||
//
|
|||
// Parameters:
|
|||
// - r: HTTP request containing method, URL, query params, and headers
|
|||
// - baseAction: Coarse-grained action constant (e.g., ACTION_WRITE, ACTION_READ)
|
|||
// - bucket: Bucket name from the request path
|
|||
// - object: Object key from the request path (may be empty for bucket operations)
|
|||
//
|
|||
// Returns:
|
|||
// - Specific S3 action string (e.g., "s3:DeleteObject")
|
|||
// - Falls back to base action mapping if no specific resolution is possible
|
|||
// - Always returns a valid S3 action string (never empty)
|
|||
func ResolveS3Action(r *http.Request, baseAction string, bucket string, object string) string { |
|||
if r == nil || r.URL == nil { |
|||
// No HTTP context available: fall back to coarse-grained mapping
|
|||
// This ensures consistent behavior and avoids returning empty strings
|
|||
return mapBaseActionToS3Format(baseAction) |
|||
} |
|||
|
|||
method := r.Method |
|||
query := r.URL.Query() |
|||
|
|||
// Determine if this is an object or bucket operation
|
|||
// Note: "/" is treated as bucket-level, not object-level
|
|||
hasObject := object != "" && object != "/" |
|||
|
|||
// Priority 1: Check for specific query parameters that indicate specific actions
|
|||
// These override everything else because they explicitly indicate the operation type
|
|||
if action := resolveFromQueryParameters(query, method, hasObject); action != "" { |
|||
return action |
|||
} |
|||
|
|||
// Priority 2: Handle basic operations based on method and resource type
|
|||
// Only use the result if a specific action was resolved; otherwise fall through to Priority 3
|
|||
if hasObject { |
|||
if action := resolveObjectLevelAction(method, baseAction); action != "" { |
|||
return action |
|||
} |
|||
} else if bucket != "" { |
|||
if action := resolveBucketLevelAction(method, baseAction); action != "" { |
|||
return action |
|||
} |
|||
} |
|||
|
|||
// Priority 3: Fallback to legacy action mapping
|
|||
return mapBaseActionToS3Format(baseAction) |
|||
} |
|||
|
|||
// bucketQueryActions maps bucket-level query parameters to their corresponding S3 actions by HTTP method
|
|||
var bucketQueryActions = map[string]map[string]string{ |
|||
"policy": { |
|||
http.MethodGet: s3_constants.S3_ACTION_GET_BUCKET_POLICY, |
|||
http.MethodPut: s3_constants.S3_ACTION_PUT_BUCKET_POLICY, |
|||
http.MethodDelete: s3_constants.S3_ACTION_DELETE_BUCKET_POLICY, |
|||
}, |
|||
"cors": { |
|||
http.MethodGet: s3_constants.S3_ACTION_GET_BUCKET_CORS, |
|||
http.MethodPut: s3_constants.S3_ACTION_PUT_BUCKET_CORS, |
|||
http.MethodDelete: s3_constants.S3_ACTION_DELETE_BUCKET_CORS, |
|||
}, |
|||
"lifecycle": { |
|||
http.MethodGet: s3_constants.S3_ACTION_GET_BUCKET_LIFECYCLE, |
|||
http.MethodPut: s3_constants.S3_ACTION_PUT_BUCKET_LIFECYCLE, |
|||
http.MethodDelete: s3_constants.S3_ACTION_PUT_BUCKET_LIFECYCLE, // DELETE uses same permission as PUT
|
|||
}, |
|||
"versioning": { |
|||
http.MethodGet: s3_constants.S3_ACTION_GET_BUCKET_VERSIONING, |
|||
http.MethodPut: s3_constants.S3_ACTION_PUT_BUCKET_VERSIONING, |
|||
}, |
|||
"notification": { |
|||
http.MethodGet: s3_constants.S3_ACTION_GET_BUCKET_NOTIFICATION, |
|||
http.MethodPut: s3_constants.S3_ACTION_PUT_BUCKET_NOTIFICATION, |
|||
}, |
|||
"object-lock": { |
|||
http.MethodGet: s3_constants.S3_ACTION_GET_BUCKET_OBJECT_LOCK, |
|||
http.MethodPut: s3_constants.S3_ACTION_PUT_BUCKET_OBJECT_LOCK, |
|||
}, |
|||
} |
|||
|
|||
// resolveFromQueryParameters checks query parameters to determine specific S3 actions
|
|||
func resolveFromQueryParameters(query url.Values, method string, hasObject bool) string { |
|||
// Multipart upload operations with uploadId parameter (object-level only)
|
|||
// All multipart operations require an object in the path
|
|||
if hasObject && query.Has("uploadId") { |
|||
switch method { |
|||
case http.MethodPut: |
|||
if query.Has("partNumber") { |
|||
return s3_constants.S3_ACTION_UPLOAD_PART |
|||
} |
|||
case http.MethodPost: |
|||
return s3_constants.S3_ACTION_COMPLETE_MULTIPART |
|||
case http.MethodDelete: |
|||
return s3_constants.S3_ACTION_ABORT_MULTIPART |
|||
case http.MethodGet: |
|||
return s3_constants.S3_ACTION_LIST_PARTS |
|||
} |
|||
} |
|||
|
|||
// Multipart upload operations
|
|||
// CreateMultipartUpload: POST /bucket/object?uploads (object-level)
|
|||
// ListMultipartUploads: GET /bucket?uploads (bucket-level)
|
|||
if query.Has("uploads") { |
|||
if method == http.MethodPost && hasObject { |
|||
return s3_constants.S3_ACTION_CREATE_MULTIPART |
|||
} else if method == http.MethodGet && !hasObject { |
|||
return s3_constants.S3_ACTION_LIST_MULTIPART_UPLOADS |
|||
} |
|||
} |
|||
|
|||
// ACL operations
|
|||
if query.Has("acl") { |
|||
switch method { |
|||
case http.MethodGet, http.MethodHead: |
|||
if hasObject { |
|||
return s3_constants.S3_ACTION_GET_OBJECT_ACL |
|||
} |
|||
return s3_constants.S3_ACTION_GET_BUCKET_ACL |
|||
case http.MethodPut: |
|||
if hasObject { |
|||
return s3_constants.S3_ACTION_PUT_OBJECT_ACL |
|||
} |
|||
return s3_constants.S3_ACTION_PUT_BUCKET_ACL |
|||
} |
|||
} |
|||
|
|||
// Tagging operations
|
|||
if query.Has("tagging") { |
|||
switch method { |
|||
case http.MethodGet: |
|||
if hasObject { |
|||
return s3_constants.S3_ACTION_GET_OBJECT_TAGGING |
|||
} |
|||
return s3_constants.S3_ACTION_GET_BUCKET_TAGGING |
|||
case http.MethodPut: |
|||
if hasObject { |
|||
return s3_constants.S3_ACTION_PUT_OBJECT_TAGGING |
|||
} |
|||
return s3_constants.S3_ACTION_PUT_BUCKET_TAGGING |
|||
case http.MethodDelete: |
|||
if hasObject { |
|||
return s3_constants.S3_ACTION_DELETE_OBJECT_TAGGING |
|||
} |
|||
return s3_constants.S3_ACTION_DELETE_BUCKET_TAGGING |
|||
} |
|||
} |
|||
|
|||
// Versioning operations - distinguish between versionId (specific version) and versions (list versions)
|
|||
// versionId: Used to access/delete a specific version of an object (e.g., GET /bucket/key?versionId=xyz)
|
|||
if query.Has("versionId") { |
|||
if hasObject { |
|||
switch method { |
|||
case http.MethodGet, http.MethodHead: |
|||
return s3_constants.S3_ACTION_GET_OBJECT_VERSION |
|||
case http.MethodDelete: |
|||
return s3_constants.S3_ACTION_DELETE_OBJECT_VERSION |
|||
} |
|||
} |
|||
} |
|||
|
|||
// versions: Used to list all versions of objects in a bucket (e.g., GET /bucket?versions)
|
|||
if query.Has("versions") { |
|||
if method == http.MethodGet && !hasObject { |
|||
return s3_constants.S3_ACTION_LIST_BUCKET_VERSIONS |
|||
} |
|||
} |
|||
|
|||
// Check bucket-level query parameters using data-driven approach
|
|||
// These are strictly bucket-level operations, so only apply when !hasObject
|
|||
if !hasObject { |
|||
for param, actions := range bucketQueryActions { |
|||
if query.Has(param) { |
|||
if action, ok := actions[method]; ok { |
|||
return action |
|||
} |
|||
} |
|||
} |
|||
} |
|||
|
|||
// Location (GET only, bucket-level)
|
|||
if query.Has("location") && method == http.MethodGet && !hasObject { |
|||
return s3_constants.S3_ACTION_GET_BUCKET_LOCATION |
|||
} |
|||
|
|||
// Object retention and legal hold operations (object-level only)
|
|||
if hasObject { |
|||
if query.Has("retention") { |
|||
switch method { |
|||
case http.MethodGet: |
|||
return s3_constants.S3_ACTION_GET_OBJECT_RETENTION |
|||
case http.MethodPut: |
|||
return s3_constants.S3_ACTION_PUT_OBJECT_RETENTION |
|||
} |
|||
} |
|||
|
|||
if query.Has("legal-hold") { |
|||
switch method { |
|||
case http.MethodGet: |
|||
return s3_constants.S3_ACTION_GET_OBJECT_LEGAL_HOLD |
|||
case http.MethodPut: |
|||
return s3_constants.S3_ACTION_PUT_OBJECT_LEGAL_HOLD |
|||
} |
|||
} |
|||
} |
|||
|
|||
// Batch delete - POST request with delete query parameter (bucket-level operation)
|
|||
// Example: POST /bucket?delete (not POST /bucket/object?delete)
|
|||
if query.Has("delete") && method == http.MethodPost && !hasObject { |
|||
return s3_constants.S3_ACTION_DELETE_OBJECT |
|||
} |
|||
|
|||
return "" |
|||
} |
|||
|
|||
// resolveObjectLevelAction determines the S3 action for object-level operations
|
|||
func resolveObjectLevelAction(method string, baseAction string) string { |
|||
switch method { |
|||
case http.MethodGet, http.MethodHead: |
|||
if baseAction == s3_constants.ACTION_READ { |
|||
return s3_constants.S3_ACTION_GET_OBJECT |
|||
} |
|||
|
|||
case http.MethodPut: |
|||
if baseAction == s3_constants.ACTION_WRITE { |
|||
// Note: CopyObject operations also use s3:PutObject permission (same as MinIO/AWS)
|
|||
// Copy requires s3:PutObject on destination and s3:GetObject on source
|
|||
return s3_constants.S3_ACTION_PUT_OBJECT |
|||
} |
|||
|
|||
case http.MethodDelete: |
|||
// CRITICAL: Map DELETE method to s3:DeleteObject
|
|||
// This fixes the architectural limitation where ACTION_WRITE was mapped to s3:PutObject
|
|||
if baseAction == s3_constants.ACTION_WRITE { |
|||
return s3_constants.S3_ACTION_DELETE_OBJECT |
|||
} |
|||
|
|||
case http.MethodPost: |
|||
// POST without query params is typically multipart or form upload
|
|||
if baseAction == s3_constants.ACTION_WRITE { |
|||
return s3_constants.S3_ACTION_PUT_OBJECT |
|||
} |
|||
} |
|||
|
|||
return "" |
|||
} |
|||
|
|||
// resolveBucketLevelAction determines the S3 action for bucket-level operations
|
|||
func resolveBucketLevelAction(method string, baseAction string) string { |
|||
switch method { |
|||
case http.MethodGet, http.MethodHead: |
|||
if baseAction == s3_constants.ACTION_LIST || baseAction == s3_constants.ACTION_READ { |
|||
return s3_constants.S3_ACTION_LIST_BUCKET |
|||
} |
|||
|
|||
case http.MethodPut: |
|||
if baseAction == s3_constants.ACTION_WRITE { |
|||
return s3_constants.S3_ACTION_CREATE_BUCKET |
|||
} |
|||
|
|||
case http.MethodDelete: |
|||
if baseAction == s3_constants.ACTION_DELETE_BUCKET { |
|||
return s3_constants.S3_ACTION_DELETE_BUCKET |
|||
} |
|||
|
|||
case http.MethodPost: |
|||
// POST to bucket is typically form upload
|
|||
if baseAction == s3_constants.ACTION_WRITE { |
|||
return s3_constants.S3_ACTION_PUT_OBJECT |
|||
} |
|||
} |
|||
|
|||
return "" |
|||
} |
|||
|
|||
// mapBaseActionToS3Format converts coarse-grained base actions to S3 format
|
|||
// This is the fallback when no specific resolution is found
|
|||
func mapBaseActionToS3Format(baseAction string) string { |
|||
// Handle actions that already have s3: prefix
|
|||
if strings.HasPrefix(baseAction, "s3:") { |
|||
return baseAction |
|||
} |
|||
|
|||
// Map coarse-grained actions to their most common S3 equivalent
|
|||
// Note: The s3_constants values ARE the string values (e.g., ACTION_READ = "Read")
|
|||
switch baseAction { |
|||
case s3_constants.ACTION_READ: // "Read"
|
|||
return s3_constants.S3_ACTION_GET_OBJECT |
|||
case s3_constants.ACTION_WRITE: // "Write"
|
|||
return s3_constants.S3_ACTION_PUT_OBJECT |
|||
case s3_constants.ACTION_LIST: // "List"
|
|||
return s3_constants.S3_ACTION_LIST_BUCKET |
|||
case s3_constants.ACTION_TAGGING: // "Tagging"
|
|||
return s3_constants.S3_ACTION_PUT_OBJECT_TAGGING |
|||
case s3_constants.ACTION_ADMIN: // "Admin"
|
|||
return s3_constants.S3_ACTION_ALL |
|||
case s3_constants.ACTION_READ_ACP: // "ReadAcp"
|
|||
return s3_constants.S3_ACTION_GET_OBJECT_ACL |
|||
case s3_constants.ACTION_WRITE_ACP: // "WriteAcp"
|
|||
return s3_constants.S3_ACTION_PUT_OBJECT_ACL |
|||
case s3_constants.ACTION_DELETE_BUCKET: // "DeleteBucket"
|
|||
return s3_constants.S3_ACTION_DELETE_BUCKET |
|||
case s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION: |
|||
return s3_constants.S3_ACTION_BYPASS_GOVERNANCE |
|||
case s3_constants.ACTION_GET_OBJECT_RETENTION: |
|||
return s3_constants.S3_ACTION_GET_OBJECT_RETENTION |
|||
case s3_constants.ACTION_PUT_OBJECT_RETENTION: |
|||
return s3_constants.S3_ACTION_PUT_OBJECT_RETENTION |
|||
case s3_constants.ACTION_GET_OBJECT_LEGAL_HOLD: |
|||
return s3_constants.S3_ACTION_GET_OBJECT_LEGAL_HOLD |
|||
case s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD: |
|||
return s3_constants.S3_ACTION_PUT_OBJECT_LEGAL_HOLD |
|||
case s3_constants.ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG: |
|||
return s3_constants.S3_ACTION_GET_BUCKET_OBJECT_LOCK |
|||
case s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG: |
|||
return s3_constants.S3_ACTION_PUT_BUCKET_OBJECT_LOCK |
|||
default: |
|||
// For unknown actions, prefix with s3: to maintain format consistency
|
|||
return "s3:" + baseAction |
|||
} |
|||
} |
|||
@ -0,0 +1,84 @@ |
|||
package s3_constants |
|||
|
|||
// S3 action strings for bucket policy evaluation
|
|||
// These match the official AWS S3 action format used in IAM and bucket policies
|
|||
const ( |
|||
// Object operations
|
|||
S3_ACTION_GET_OBJECT = "s3:GetObject" |
|||
S3_ACTION_PUT_OBJECT = "s3:PutObject" |
|||
S3_ACTION_DELETE_OBJECT = "s3:DeleteObject" |
|||
S3_ACTION_DELETE_OBJECT_VERSION = "s3:DeleteObjectVersion" |
|||
S3_ACTION_GET_OBJECT_VERSION = "s3:GetObjectVersion" |
|||
|
|||
// Object ACL operations
|
|||
S3_ACTION_GET_OBJECT_ACL = "s3:GetObjectAcl" |
|||
S3_ACTION_PUT_OBJECT_ACL = "s3:PutObjectAcl" |
|||
|
|||
// Object tagging operations
|
|||
S3_ACTION_GET_OBJECT_TAGGING = "s3:GetObjectTagging" |
|||
S3_ACTION_PUT_OBJECT_TAGGING = "s3:PutObjectTagging" |
|||
S3_ACTION_DELETE_OBJECT_TAGGING = "s3:DeleteObjectTagging" |
|||
|
|||
// Object retention and legal hold
|
|||
S3_ACTION_GET_OBJECT_RETENTION = "s3:GetObjectRetention" |
|||
S3_ACTION_PUT_OBJECT_RETENTION = "s3:PutObjectRetention" |
|||
S3_ACTION_GET_OBJECT_LEGAL_HOLD = "s3:GetObjectLegalHold" |
|||
S3_ACTION_PUT_OBJECT_LEGAL_HOLD = "s3:PutObjectLegalHold" |
|||
S3_ACTION_BYPASS_GOVERNANCE = "s3:BypassGovernanceRetention" |
|||
|
|||
// Multipart upload operations
|
|||
S3_ACTION_CREATE_MULTIPART = "s3:CreateMultipartUpload" |
|||
S3_ACTION_UPLOAD_PART = "s3:UploadPart" |
|||
S3_ACTION_COMPLETE_MULTIPART = "s3:CompleteMultipartUpload" |
|||
S3_ACTION_ABORT_MULTIPART = "s3:AbortMultipartUpload" |
|||
S3_ACTION_LIST_PARTS = "s3:ListMultipartUploadParts" |
|||
|
|||
// Bucket operations
|
|||
S3_ACTION_CREATE_BUCKET = "s3:CreateBucket" |
|||
S3_ACTION_DELETE_BUCKET = "s3:DeleteBucket" |
|||
S3_ACTION_LIST_BUCKET = "s3:ListBucket" |
|||
S3_ACTION_LIST_BUCKET_VERSIONS = "s3:ListBucketVersions" |
|||
S3_ACTION_LIST_MULTIPART_UPLOADS = "s3:ListBucketMultipartUploads" |
|||
|
|||
// Bucket ACL operations
|
|||
S3_ACTION_GET_BUCKET_ACL = "s3:GetBucketAcl" |
|||
S3_ACTION_PUT_BUCKET_ACL = "s3:PutBucketAcl" |
|||
|
|||
// Bucket policy operations
|
|||
S3_ACTION_GET_BUCKET_POLICY = "s3:GetBucketPolicy" |
|||
S3_ACTION_PUT_BUCKET_POLICY = "s3:PutBucketPolicy" |
|||
S3_ACTION_DELETE_BUCKET_POLICY = "s3:DeleteBucketPolicy" |
|||
|
|||
// Bucket tagging operations
|
|||
S3_ACTION_GET_BUCKET_TAGGING = "s3:GetBucketTagging" |
|||
S3_ACTION_PUT_BUCKET_TAGGING = "s3:PutBucketTagging" |
|||
S3_ACTION_DELETE_BUCKET_TAGGING = "s3:DeleteBucketTagging" |
|||
|
|||
// Bucket CORS operations
|
|||
S3_ACTION_GET_BUCKET_CORS = "s3:GetBucketCors" |
|||
S3_ACTION_PUT_BUCKET_CORS = "s3:PutBucketCors" |
|||
S3_ACTION_DELETE_BUCKET_CORS = "s3:DeleteBucketCors" |
|||
|
|||
// Bucket lifecycle operations
|
|||
// Note: Both PUT and DELETE lifecycle operations use s3:PutLifecycleConfiguration
|
|||
S3_ACTION_GET_BUCKET_LIFECYCLE = "s3:GetLifecycleConfiguration" |
|||
S3_ACTION_PUT_BUCKET_LIFECYCLE = "s3:PutLifecycleConfiguration" |
|||
|
|||
// Bucket versioning operations
|
|||
S3_ACTION_GET_BUCKET_VERSIONING = "s3:GetBucketVersioning" |
|||
S3_ACTION_PUT_BUCKET_VERSIONING = "s3:PutBucketVersioning" |
|||
|
|||
// Bucket location
|
|||
S3_ACTION_GET_BUCKET_LOCATION = "s3:GetBucketLocation" |
|||
|
|||
// Bucket notification
|
|||
S3_ACTION_GET_BUCKET_NOTIFICATION = "s3:GetBucketNotification" |
|||
S3_ACTION_PUT_BUCKET_NOTIFICATION = "s3:PutBucketNotification" |
|||
|
|||
// Bucket object lock operations
|
|||
S3_ACTION_GET_BUCKET_OBJECT_LOCK = "s3:GetBucketObjectLockConfiguration" |
|||
S3_ACTION_PUT_BUCKET_OBJECT_LOCK = "s3:PutBucketObjectLockConfiguration" |
|||
|
|||
// Wildcard for all S3 actions
|
|||
S3_ACTION_ALL = "s3:*" |
|||
) |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue