Browse Source
s3: add s3:ExistingObjectTag condition support for bucket policies (#7677)
s3: add s3:ExistingObjectTag condition support for bucket policies (#7677)
* s3: add s3:ExistingObjectTag condition support in policy engine
Add support for s3:ExistingObjectTag/<tag-key> condition keys in bucket
policies, allowing access control based on object tags.
Changes:
- Add ObjectEntry field to PolicyEvaluationArgs (entry.Extended metadata)
- Update EvaluateConditions to handle s3:ExistingObjectTag/<key> format
- Extract tag value from entry metadata using X-Amz-Tagging-<key> prefix
This enables policies like:
{
"Condition": {
"StringEquals": {
"s3:ExistingObjectTag/status": ["public"]
}
}
}
Fixes: https://github.com/seaweedfs/seaweedfs/issues/7447
* s3: update EvaluatePolicy to accept object entry for tag conditions
Update BucketPolicyEngine.EvaluatePolicy to accept objectEntry parameter
(entry.Extended metadata) for evaluating tag-based policy conditions.
Changes:
- Add objectEntry parameter to EvaluatePolicy method
- Update callers in auth_credentials.go and s3api_bucket_handlers.go
- Pass nil for objectEntry in auth layer (entry fetched later in handlers)
For tag-based conditions to work, handlers should call EvaluatePolicy
with the object's entry.Extended after fetching the entry from filer.
* s3: add tests for s3:ExistingObjectTag policy conditions
Add comprehensive tests for object tag-based policy conditions:
- TestExistingObjectTagCondition: Basic tag matching scenarios
- Matching/non-matching tag values
- Missing tags, no tags, empty tags
- Multiple tags with one matching
- TestExistingObjectTagConditionMultipleTags: Multiple tag conditions
- Both tags match
- Only one tag matches
- TestExistingObjectTagDenyPolicy: Deny policies with tag conditions
- Default allow without tag
- Deny when specific tag present
* s3: document s3:ExistingObjectTag support and feature status
Update policy engine documentation:
- Add s3:ExistingObjectTag/<tag-key> to supported condition keys
- Add 'Object Tag-Based Access Control' section with examples
- Add 'Feature Status' section with implemented and planned features
Planned features for future implementation:
- s3:RequestObjectTag/<key>
- s3:RequestObjectTagKeys
- s3:x-amz-server-side-encryption
- Cross-account access
* Implement tag-based policy re-check in handlers
- Add checkPolicyWithEntry helper to S3ApiServer for handlers to re-check
policy after fetching object entry (for s3:ExistingObjectTag conditions)
- Add HasPolicyForBucket method to policy engine for efficient check
- Integrate policy re-check in GetObjectHandler after entry is fetched
- Integrate policy re-check in HeadObjectHandler after entry is fetched
- Update auth_credentials.go comments to explain two-phase evaluation
- Update documentation with supported operations for tag-based conditions
This implements 'Approach 1' where handlers re-check the policy with
the object entry after fetching it, allowing tag-based conditions to
be properly evaluated.
* Add integration tests for s3:ExistingObjectTag conditions
- Add TestCheckPolicyWithEntry: tests checkPolicyWithEntry helper with various
tag scenarios (matching tags, non-matching tags, empty entry, nil entry)
- Add TestCheckPolicyWithEntryNoPolicyForBucket: tests early return when no policy
- Add TestCheckPolicyWithEntryNilPolicyEngine: tests nil engine handling
- Add TestCheckPolicyWithEntryDenyPolicy: tests deny policies with tag conditions
- Add TestHasPolicyForBucket: tests HasPolicyForBucket method
These tests cover the Phase 2 policy evaluation with object entry metadata,
ensuring tag-based conditions are properly evaluated.
* Address code review nitpicks
- Remove unused extractObjectTags placeholder function (engine.go)
- Add clarifying comment about s3:ExistingObjectTag/<key> evaluation
- Consolidate duplicate tag-based examples in README
- Factor out tagsToEntry helper to package level in tests
* Address code review feedback
- Fix unsafe type assertions in GetObjectHandler and HeadObjectHandler
when getting identity from context (properly handle type assertion failure)
- Extract getConditionContextValue helper to eliminate duplicated logic
between EvaluateConditions and EvaluateConditionsLegacy
- Ensure consistent handling of missing condition keys (always return
empty slice)
* Fix GetObjectHandler to match HeadObjectHandler pattern
Add safety check for nil objectEntryForSSE before tag-based policy
evaluation, ensuring tag-based conditions are always evaluated rather
than silently skipped if entry is unexpectedly nil.
Addresses review comment from Copilot.
* Fix HeadObject action name in docs for consistency
Change 'HeadObject' to 's3:HeadObject' to match other action names.
* Extract recheckPolicyWithObjectEntry helper to reduce duplication
Move the repeated identity extraction and policy re-check logic from
GetObjectHandler and HeadObjectHandler into a shared helper method.
* Add validation for empty tag key in s3:ExistingObjectTag condition
Prevent potential issues with malformed policies containing
s3:ExistingObjectTag/ (empty tag key after slash).
pull/7607/merge
Chris Lu
22 hours ago
committed by
GitHub
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
11 changed files with 762 additions and 105 deletions
-
6weed/s3api/auth_credentials.go
-
105weed/s3api/policy_engine/README_POLICY_ENGINE.md
-
46weed/s3api/policy_engine/conditions.go
-
32weed/s3api/policy_engine/engine.go
-
244weed/s3api/policy_engine/engine_test.go
-
5weed/s3api/policy_engine/types.go
-
260weed/s3api/s3_existing_object_tag_test.go
-
4weed/s3api/s3api_bucket_handlers.go
-
90weed/s3api/s3api_bucket_policy_engine.go
-
19weed/s3api/s3api_object_handlers.go
-
56weed/s3api/s3api_server.go
@ -0,0 +1,260 @@ |
|||
package s3api |
|||
|
|||
import ( |
|||
"net/http" |
|||
"net/http/httptest" |
|||
"testing" |
|||
|
|||
"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine" |
|||
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants" |
|||
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err" |
|||
"github.com/stretchr/testify/assert" |
|||
"github.com/stretchr/testify/require" |
|||
) |
|||
|
|||
// TestCheckPolicyWithEntry tests the checkPolicyWithEntry helper method
|
|||
// This verifies that tag-based conditions are properly evaluated when
|
|||
// the object entry is available (Phase 2 of policy evaluation)
|
|||
func TestCheckPolicyWithEntry(t *testing.T) { |
|||
// Create a minimal S3ApiServer with policy engine
|
|||
s3a := &S3ApiServer{ |
|||
policyEngine: NewBucketPolicyEngine(), |
|||
} |
|||
|
|||
bucket := "test-bucket" |
|||
|
|||
// Set up a policy that allows access only to objects with status=public tag
|
|||
policyJSON := `{ |
|||
"Version": "2012-10-17", |
|||
"Statement": [ |
|||
{ |
|||
"Effect": "Allow", |
|||
"Principal": "*", |
|||
"Action": "s3:GetObject", |
|||
"Resource": "arn:aws:s3:::test-bucket/*", |
|||
"Condition": { |
|||
"StringEquals": { |
|||
"s3:ExistingObjectTag/status": ["public"] |
|||
} |
|||
} |
|||
} |
|||
] |
|||
}` |
|||
|
|||
err := s3a.policyEngine.engine.SetBucketPolicy(bucket, policyJSON) |
|||
require.NoError(t, err) |
|||
|
|||
tests := []struct { |
|||
name string |
|||
objectEntry map[string][]byte |
|||
wantErrCode s3err.ErrorCode |
|||
wantChecked bool |
|||
description string |
|||
}{ |
|||
{ |
|||
name: "object with public tag - allow", |
|||
objectEntry: map[string][]byte{ |
|||
s3_constants.AmzObjectTaggingPrefix + "status": []byte("public"), |
|||
}, |
|||
wantErrCode: s3err.ErrNone, |
|||
wantChecked: true, |
|||
description: "Object with status=public tag should be allowed", |
|||
}, |
|||
{ |
|||
name: "object with private tag - indeterminate (no matching statement)", |
|||
objectEntry: map[string][]byte{ |
|||
s3_constants.AmzObjectTaggingPrefix + "status": []byte("private"), |
|||
}, |
|||
wantErrCode: s3err.ErrNone, |
|||
wantChecked: false, // Indeterminate = no policy matched
|
|||
description: "Object with status=private should return indeterminate (falls back to IAM)", |
|||
}, |
|||
{ |
|||
name: "object with no tags - indeterminate (no matching statement)", |
|||
objectEntry: map[string][]byte{}, |
|||
wantErrCode: s3err.ErrNone, |
|||
wantChecked: false, // Indeterminate = no policy matched
|
|||
description: "Object without tags should return indeterminate (falls back to IAM)", |
|||
}, |
|||
{ |
|||
name: "nil entry - indeterminate (condition cannot be evaluated)", |
|||
objectEntry: nil, |
|||
wantErrCode: s3err.ErrNone, |
|||
wantChecked: false, // Indeterminate = no policy matched
|
|||
description: "Nil entry should return indeterminate (falls back to IAM)", |
|||
}, |
|||
{ |
|||
name: "object with multiple tags including public - allow", |
|||
objectEntry: map[string][]byte{ |
|||
s3_constants.AmzObjectTaggingPrefix + "status": []byte("public"), |
|||
s3_constants.AmzObjectTaggingPrefix + "category": []byte("documents"), |
|||
}, |
|||
wantErrCode: s3err.ErrNone, |
|||
wantChecked: true, |
|||
description: "Object with status=public among other tags should be allowed", |
|||
}, |
|||
} |
|||
|
|||
for _, tt := range tests { |
|||
t.Run(tt.name, func(t *testing.T) { |
|||
req := httptest.NewRequest(http.MethodGet, "/test-bucket/test-object.txt", nil) |
|||
object := "/test-object.txt" |
|||
principal := "*" |
|||
action := string(s3_constants.ACTION_READ) |
|||
|
|||
errCode, checked := s3a.checkPolicyWithEntry(req, bucket, object, action, principal, tt.objectEntry) |
|||
|
|||
assert.Equal(t, tt.wantErrCode, errCode, tt.description) |
|||
assert.Equal(t, tt.wantChecked, checked, "Policy should be evaluated") |
|||
}) |
|||
} |
|||
} |
|||
|
|||
// TestCheckPolicyWithEntryNoPolicyForBucket tests that checkPolicyWithEntry
|
|||
// returns early when there's no policy for the bucket
|
|||
func TestCheckPolicyWithEntryNoPolicyForBucket(t *testing.T) { |
|||
s3a := &S3ApiServer{ |
|||
policyEngine: NewBucketPolicyEngine(), |
|||
} |
|||
|
|||
bucket := "bucket-without-policy" |
|||
req := httptest.NewRequest(http.MethodGet, "/bucket-without-policy/test.txt", nil) |
|||
|
|||
objectEntry := map[string][]byte{ |
|||
s3_constants.AmzObjectTaggingPrefix + "status": []byte("private"), |
|||
} |
|||
|
|||
errCode, checked := s3a.checkPolicyWithEntry(req, bucket, "/test.txt", string(s3_constants.ACTION_READ), "*", objectEntry) |
|||
|
|||
assert.Equal(t, s3err.ErrNone, errCode, "No policy should mean no denial") |
|||
assert.False(t, checked, "Policy should not be evaluated when bucket has no policy") |
|||
} |
|||
|
|||
// TestCheckPolicyWithEntryNilPolicyEngine tests that checkPolicyWithEntry
|
|||
// handles nil policy engine gracefully
|
|||
func TestCheckPolicyWithEntryNilPolicyEngine(t *testing.T) { |
|||
s3a := &S3ApiServer{ |
|||
policyEngine: nil, |
|||
} |
|||
|
|||
req := httptest.NewRequest(http.MethodGet, "/test-bucket/test.txt", nil) |
|||
|
|||
errCode, checked := s3a.checkPolicyWithEntry(req, "test-bucket", "/test.txt", string(s3_constants.ACTION_READ), "*", nil) |
|||
|
|||
assert.Equal(t, s3err.ErrNone, errCode, "Nil policy engine should allow access") |
|||
assert.False(t, checked, "Policy should not be evaluated when engine is nil") |
|||
} |
|||
|
|||
// TestCheckPolicyWithEntryDenyPolicy tests deny policies with tag conditions
|
|||
func TestCheckPolicyWithEntryDenyPolicy(t *testing.T) { |
|||
s3a := &S3ApiServer{ |
|||
policyEngine: NewBucketPolicyEngine(), |
|||
} |
|||
|
|||
bucket := "secure-bucket" |
|||
|
|||
// Policy that allows all access but denies access to confidential objects
|
|||
policyJSON := `{ |
|||
"Version": "2012-10-17", |
|||
"Statement": [ |
|||
{ |
|||
"Effect": "Allow", |
|||
"Principal": "*", |
|||
"Action": "s3:GetObject", |
|||
"Resource": "arn:aws:s3:::secure-bucket/*" |
|||
}, |
|||
{ |
|||
"Effect": "Deny", |
|||
"Principal": "*", |
|||
"Action": "s3:GetObject", |
|||
"Resource": "arn:aws:s3:::secure-bucket/*", |
|||
"Condition": { |
|||
"StringEquals": { |
|||
"s3:ExistingObjectTag/classification": ["confidential"] |
|||
} |
|||
} |
|||
} |
|||
] |
|||
}` |
|||
|
|||
err := s3a.policyEngine.engine.SetBucketPolicy(bucket, policyJSON) |
|||
require.NoError(t, err) |
|||
|
|||
tests := []struct { |
|||
name string |
|||
objectEntry map[string][]byte |
|||
wantErrCode s3err.ErrorCode |
|||
description string |
|||
}{ |
|||
{ |
|||
name: "public object - allow", |
|||
objectEntry: map[string][]byte{ |
|||
s3_constants.AmzObjectTaggingPrefix + "classification": []byte("public"), |
|||
}, |
|||
wantErrCode: s3err.ErrNone, |
|||
description: "Object with classification=public should be allowed", |
|||
}, |
|||
{ |
|||
name: "confidential object - deny", |
|||
objectEntry: map[string][]byte{ |
|||
s3_constants.AmzObjectTaggingPrefix + "classification": []byte("confidential"), |
|||
}, |
|||
wantErrCode: s3err.ErrAccessDenied, |
|||
description: "Object with classification=confidential should be denied by explicit deny", |
|||
}, |
|||
{ |
|||
name: "no classification tag - allow", |
|||
objectEntry: map[string][]byte{}, |
|||
wantErrCode: s3err.ErrNone, |
|||
description: "Object without classification tag should be allowed (deny condition not met)", |
|||
}, |
|||
} |
|||
|
|||
for _, tt := range tests { |
|||
t.Run(tt.name, func(t *testing.T) { |
|||
req := httptest.NewRequest(http.MethodGet, "/secure-bucket/test.txt", nil) |
|||
|
|||
errCode, checked := s3a.checkPolicyWithEntry(req, bucket, "/test.txt", string(s3_constants.ACTION_READ), "*", tt.objectEntry) |
|||
|
|||
assert.Equal(t, tt.wantErrCode, errCode, tt.description) |
|||
assert.True(t, checked, "Policy should be evaluated") |
|||
}) |
|||
} |
|||
} |
|||
|
|||
// TestHasPolicyForBucket tests the HasPolicyForBucket method
|
|||
func TestHasPolicyForBucket(t *testing.T) { |
|||
engine := policy_engine.NewPolicyEngine() |
|||
|
|||
// Initially no policy
|
|||
assert.False(t, engine.HasPolicyForBucket("test-bucket")) |
|||
|
|||
// Set a policy
|
|||
policyJSON := `{ |
|||
"Version": "2012-10-17", |
|||
"Statement": [ |
|||
{ |
|||
"Effect": "Allow", |
|||
"Principal": "*", |
|||
"Action": "s3:GetObject", |
|||
"Resource": "arn:aws:s3:::test-bucket/*" |
|||
} |
|||
] |
|||
}` |
|||
err := engine.SetBucketPolicy("test-bucket", policyJSON) |
|||
require.NoError(t, err) |
|||
|
|||
// Now has policy
|
|||
assert.True(t, engine.HasPolicyForBucket("test-bucket")) |
|||
|
|||
// Other bucket still has no policy
|
|||
assert.False(t, engine.HasPolicyForBucket("other-bucket")) |
|||
|
|||
// Delete the policy
|
|||
err = engine.DeleteBucketPolicy("test-bucket") |
|||
require.NoError(t, err) |
|||
|
|||
// No longer has policy
|
|||
assert.False(t, engine.HasPolicyForBucket("test-bucket")) |
|||
} |
|||
|
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue