Browse Source
s3: add s3:ExistingObjectTag condition support for bucket policies (#7677)
s3: add s3:ExistingObjectTag condition support for bucket policies (#7677)
* s3: add s3:ExistingObjectTag condition support in policy engine
Add support for s3:ExistingObjectTag/<tag-key> condition keys in bucket
policies, allowing access control based on object tags.
Changes:
- Add ObjectEntry field to PolicyEvaluationArgs (entry.Extended metadata)
- Update EvaluateConditions to handle s3:ExistingObjectTag/<key> format
- Extract tag value from entry metadata using X-Amz-Tagging-<key> prefix
This enables policies like:
{
"Condition": {
"StringEquals": {
"s3:ExistingObjectTag/status": ["public"]
}
}
}
Fixes: https://github.com/seaweedfs/seaweedfs/issues/7447
* s3: update EvaluatePolicy to accept object entry for tag conditions
Update BucketPolicyEngine.EvaluatePolicy to accept objectEntry parameter
(entry.Extended metadata) for evaluating tag-based policy conditions.
Changes:
- Add objectEntry parameter to EvaluatePolicy method
- Update callers in auth_credentials.go and s3api_bucket_handlers.go
- Pass nil for objectEntry in auth layer (entry fetched later in handlers)
For tag-based conditions to work, handlers should call EvaluatePolicy
with the object's entry.Extended after fetching the entry from filer.
* s3: add tests for s3:ExistingObjectTag policy conditions
Add comprehensive tests for object tag-based policy conditions:
- TestExistingObjectTagCondition: Basic tag matching scenarios
- Matching/non-matching tag values
- Missing tags, no tags, empty tags
- Multiple tags with one matching
- TestExistingObjectTagConditionMultipleTags: Multiple tag conditions
- Both tags match
- Only one tag matches
- TestExistingObjectTagDenyPolicy: Deny policies with tag conditions
- Default allow without tag
- Deny when specific tag present
* s3: document s3:ExistingObjectTag support and feature status
Update policy engine documentation:
- Add s3:ExistingObjectTag/<tag-key> to supported condition keys
- Add 'Object Tag-Based Access Control' section with examples
- Add 'Feature Status' section with implemented and planned features
Planned features for future implementation:
- s3:RequestObjectTag/<key>
- s3:RequestObjectTagKeys
- s3:x-amz-server-side-encryption
- Cross-account access
* Implement tag-based policy re-check in handlers
- Add checkPolicyWithEntry helper to S3ApiServer for handlers to re-check
policy after fetching object entry (for s3:ExistingObjectTag conditions)
- Add HasPolicyForBucket method to policy engine for efficient check
- Integrate policy re-check in GetObjectHandler after entry is fetched
- Integrate policy re-check in HeadObjectHandler after entry is fetched
- Update auth_credentials.go comments to explain two-phase evaluation
- Update documentation with supported operations for tag-based conditions
This implements 'Approach 1' where handlers re-check the policy with
the object entry after fetching it, allowing tag-based conditions to
be properly evaluated.
* Add integration tests for s3:ExistingObjectTag conditions
- Add TestCheckPolicyWithEntry: tests checkPolicyWithEntry helper with various
tag scenarios (matching tags, non-matching tags, empty entry, nil entry)
- Add TestCheckPolicyWithEntryNoPolicyForBucket: tests early return when no policy
- Add TestCheckPolicyWithEntryNilPolicyEngine: tests nil engine handling
- Add TestCheckPolicyWithEntryDenyPolicy: tests deny policies with tag conditions
- Add TestHasPolicyForBucket: tests HasPolicyForBucket method
These tests cover the Phase 2 policy evaluation with object entry metadata,
ensuring tag-based conditions are properly evaluated.
* Address code review nitpicks
- Remove unused extractObjectTags placeholder function (engine.go)
- Add clarifying comment about s3:ExistingObjectTag/<key> evaluation
- Consolidate duplicate tag-based examples in README
- Factor out tagsToEntry helper to package level in tests
* Address code review feedback
- Fix unsafe type assertions in GetObjectHandler and HeadObjectHandler
when getting identity from context (properly handle type assertion failure)
- Extract getConditionContextValue helper to eliminate duplicated logic
between EvaluateConditions and EvaluateConditionsLegacy
- Ensure consistent handling of missing condition keys (always return
empty slice)
* Fix GetObjectHandler to match HeadObjectHandler pattern
Add safety check for nil objectEntryForSSE before tag-based policy
evaluation, ensuring tag-based conditions are always evaluated rather
than silently skipped if entry is unexpectedly nil.
Addresses review comment from Copilot.
* Fix HeadObject action name in docs for consistency
Change 'HeadObject' to 's3:HeadObject' to match other action names.
* Extract recheckPolicyWithObjectEntry helper to reduce duplication
Move the repeated identity extraction and policy re-check logic from
GetObjectHandler and HeadObjectHandler into a shared helper method.
* Add validation for empty tag key in s3:ExistingObjectTag condition
Prevent potential issues with malformed policies containing
s3:ExistingObjectTag/ (empty tag key after slash).
pull/2932/merge
Chris Lu
2 days ago
committed by
GitHub
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
11 changed files with 762 additions and 105 deletions
-
6weed/s3api/auth_credentials.go
-
105weed/s3api/policy_engine/README_POLICY_ENGINE.md
-
46weed/s3api/policy_engine/conditions.go
-
32weed/s3api/policy_engine/engine.go
-
244weed/s3api/policy_engine/engine_test.go
-
5weed/s3api/policy_engine/types.go
-
260weed/s3api/s3_existing_object_tag_test.go
-
4weed/s3api/s3api_bucket_handlers.go
-
90weed/s3api/s3api_bucket_policy_engine.go
-
19weed/s3api/s3api_object_handlers.go
-
56weed/s3api/s3api_server.go
@ -0,0 +1,260 @@ |
|||||
|
package s3api |
||||
|
|
||||
|
import ( |
||||
|
"net/http" |
||||
|
"net/http/httptest" |
||||
|
"testing" |
||||
|
|
||||
|
"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine" |
||||
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants" |
||||
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err" |
||||
|
"github.com/stretchr/testify/assert" |
||||
|
"github.com/stretchr/testify/require" |
||||
|
) |
||||
|
|
||||
|
// TestCheckPolicyWithEntry tests the checkPolicyWithEntry helper method
|
||||
|
// This verifies that tag-based conditions are properly evaluated when
|
||||
|
// the object entry is available (Phase 2 of policy evaluation)
|
||||
|
func TestCheckPolicyWithEntry(t *testing.T) { |
||||
|
// Create a minimal S3ApiServer with policy engine
|
||||
|
s3a := &S3ApiServer{ |
||||
|
policyEngine: NewBucketPolicyEngine(), |
||||
|
} |
||||
|
|
||||
|
bucket := "test-bucket" |
||||
|
|
||||
|
// Set up a policy that allows access only to objects with status=public tag
|
||||
|
policyJSON := `{ |
||||
|
"Version": "2012-10-17", |
||||
|
"Statement": [ |
||||
|
{ |
||||
|
"Effect": "Allow", |
||||
|
"Principal": "*", |
||||
|
"Action": "s3:GetObject", |
||||
|
"Resource": "arn:aws:s3:::test-bucket/*", |
||||
|
"Condition": { |
||||
|
"StringEquals": { |
||||
|
"s3:ExistingObjectTag/status": ["public"] |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
] |
||||
|
}` |
||||
|
|
||||
|
err := s3a.policyEngine.engine.SetBucketPolicy(bucket, policyJSON) |
||||
|
require.NoError(t, err) |
||||
|
|
||||
|
tests := []struct { |
||||
|
name string |
||||
|
objectEntry map[string][]byte |
||||
|
wantErrCode s3err.ErrorCode |
||||
|
wantChecked bool |
||||
|
description string |
||||
|
}{ |
||||
|
{ |
||||
|
name: "object with public tag - allow", |
||||
|
objectEntry: map[string][]byte{ |
||||
|
s3_constants.AmzObjectTaggingPrefix + "status": []byte("public"), |
||||
|
}, |
||||
|
wantErrCode: s3err.ErrNone, |
||||
|
wantChecked: true, |
||||
|
description: "Object with status=public tag should be allowed", |
||||
|
}, |
||||
|
{ |
||||
|
name: "object with private tag - indeterminate (no matching statement)", |
||||
|
objectEntry: map[string][]byte{ |
||||
|
s3_constants.AmzObjectTaggingPrefix + "status": []byte("private"), |
||||
|
}, |
||||
|
wantErrCode: s3err.ErrNone, |
||||
|
wantChecked: false, // Indeterminate = no policy matched
|
||||
|
description: "Object with status=private should return indeterminate (falls back to IAM)", |
||||
|
}, |
||||
|
{ |
||||
|
name: "object with no tags - indeterminate (no matching statement)", |
||||
|
objectEntry: map[string][]byte{}, |
||||
|
wantErrCode: s3err.ErrNone, |
||||
|
wantChecked: false, // Indeterminate = no policy matched
|
||||
|
description: "Object without tags should return indeterminate (falls back to IAM)", |
||||
|
}, |
||||
|
{ |
||||
|
name: "nil entry - indeterminate (condition cannot be evaluated)", |
||||
|
objectEntry: nil, |
||||
|
wantErrCode: s3err.ErrNone, |
||||
|
wantChecked: false, // Indeterminate = no policy matched
|
||||
|
description: "Nil entry should return indeterminate (falls back to IAM)", |
||||
|
}, |
||||
|
{ |
||||
|
name: "object with multiple tags including public - allow", |
||||
|
objectEntry: map[string][]byte{ |
||||
|
s3_constants.AmzObjectTaggingPrefix + "status": []byte("public"), |
||||
|
s3_constants.AmzObjectTaggingPrefix + "category": []byte("documents"), |
||||
|
}, |
||||
|
wantErrCode: s3err.ErrNone, |
||||
|
wantChecked: true, |
||||
|
description: "Object with status=public among other tags should be allowed", |
||||
|
}, |
||||
|
} |
||||
|
|
||||
|
for _, tt := range tests { |
||||
|
t.Run(tt.name, func(t *testing.T) { |
||||
|
req := httptest.NewRequest(http.MethodGet, "/test-bucket/test-object.txt", nil) |
||||
|
object := "/test-object.txt" |
||||
|
principal := "*" |
||||
|
action := string(s3_constants.ACTION_READ) |
||||
|
|
||||
|
errCode, checked := s3a.checkPolicyWithEntry(req, bucket, object, action, principal, tt.objectEntry) |
||||
|
|
||||
|
assert.Equal(t, tt.wantErrCode, errCode, tt.description) |
||||
|
assert.Equal(t, tt.wantChecked, checked, "Policy should be evaluated") |
||||
|
}) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// TestCheckPolicyWithEntryNoPolicyForBucket tests that checkPolicyWithEntry
|
||||
|
// returns early when there's no policy for the bucket
|
||||
|
func TestCheckPolicyWithEntryNoPolicyForBucket(t *testing.T) { |
||||
|
s3a := &S3ApiServer{ |
||||
|
policyEngine: NewBucketPolicyEngine(), |
||||
|
} |
||||
|
|
||||
|
bucket := "bucket-without-policy" |
||||
|
req := httptest.NewRequest(http.MethodGet, "/bucket-without-policy/test.txt", nil) |
||||
|
|
||||
|
objectEntry := map[string][]byte{ |
||||
|
s3_constants.AmzObjectTaggingPrefix + "status": []byte("private"), |
||||
|
} |
||||
|
|
||||
|
errCode, checked := s3a.checkPolicyWithEntry(req, bucket, "/test.txt", string(s3_constants.ACTION_READ), "*", objectEntry) |
||||
|
|
||||
|
assert.Equal(t, s3err.ErrNone, errCode, "No policy should mean no denial") |
||||
|
assert.False(t, checked, "Policy should not be evaluated when bucket has no policy") |
||||
|
} |
||||
|
|
||||
|
// TestCheckPolicyWithEntryNilPolicyEngine tests that checkPolicyWithEntry
|
||||
|
// handles nil policy engine gracefully
|
||||
|
func TestCheckPolicyWithEntryNilPolicyEngine(t *testing.T) { |
||||
|
s3a := &S3ApiServer{ |
||||
|
policyEngine: nil, |
||||
|
} |
||||
|
|
||||
|
req := httptest.NewRequest(http.MethodGet, "/test-bucket/test.txt", nil) |
||||
|
|
||||
|
errCode, checked := s3a.checkPolicyWithEntry(req, "test-bucket", "/test.txt", string(s3_constants.ACTION_READ), "*", nil) |
||||
|
|
||||
|
assert.Equal(t, s3err.ErrNone, errCode, "Nil policy engine should allow access") |
||||
|
assert.False(t, checked, "Policy should not be evaluated when engine is nil") |
||||
|
} |
||||
|
|
||||
|
// TestCheckPolicyWithEntryDenyPolicy tests deny policies with tag conditions
|
||||
|
func TestCheckPolicyWithEntryDenyPolicy(t *testing.T) { |
||||
|
s3a := &S3ApiServer{ |
||||
|
policyEngine: NewBucketPolicyEngine(), |
||||
|
} |
||||
|
|
||||
|
bucket := "secure-bucket" |
||||
|
|
||||
|
// Policy that allows all access but denies access to confidential objects
|
||||
|
policyJSON := `{ |
||||
|
"Version": "2012-10-17", |
||||
|
"Statement": [ |
||||
|
{ |
||||
|
"Effect": "Allow", |
||||
|
"Principal": "*", |
||||
|
"Action": "s3:GetObject", |
||||
|
"Resource": "arn:aws:s3:::secure-bucket/*" |
||||
|
}, |
||||
|
{ |
||||
|
"Effect": "Deny", |
||||
|
"Principal": "*", |
||||
|
"Action": "s3:GetObject", |
||||
|
"Resource": "arn:aws:s3:::secure-bucket/*", |
||||
|
"Condition": { |
||||
|
"StringEquals": { |
||||
|
"s3:ExistingObjectTag/classification": ["confidential"] |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
] |
||||
|
}` |
||||
|
|
||||
|
err := s3a.policyEngine.engine.SetBucketPolicy(bucket, policyJSON) |
||||
|
require.NoError(t, err) |
||||
|
|
||||
|
tests := []struct { |
||||
|
name string |
||||
|
objectEntry map[string][]byte |
||||
|
wantErrCode s3err.ErrorCode |
||||
|
description string |
||||
|
}{ |
||||
|
{ |
||||
|
name: "public object - allow", |
||||
|
objectEntry: map[string][]byte{ |
||||
|
s3_constants.AmzObjectTaggingPrefix + "classification": []byte("public"), |
||||
|
}, |
||||
|
wantErrCode: s3err.ErrNone, |
||||
|
description: "Object with classification=public should be allowed", |
||||
|
}, |
||||
|
{ |
||||
|
name: "confidential object - deny", |
||||
|
objectEntry: map[string][]byte{ |
||||
|
s3_constants.AmzObjectTaggingPrefix + "classification": []byte("confidential"), |
||||
|
}, |
||||
|
wantErrCode: s3err.ErrAccessDenied, |
||||
|
description: "Object with classification=confidential should be denied by explicit deny", |
||||
|
}, |
||||
|
{ |
||||
|
name: "no classification tag - allow", |
||||
|
objectEntry: map[string][]byte{}, |
||||
|
wantErrCode: s3err.ErrNone, |
||||
|
description: "Object without classification tag should be allowed (deny condition not met)", |
||||
|
}, |
||||
|
} |
||||
|
|
||||
|
for _, tt := range tests { |
||||
|
t.Run(tt.name, func(t *testing.T) { |
||||
|
req := httptest.NewRequest(http.MethodGet, "/secure-bucket/test.txt", nil) |
||||
|
|
||||
|
errCode, checked := s3a.checkPolicyWithEntry(req, bucket, "/test.txt", string(s3_constants.ACTION_READ), "*", tt.objectEntry) |
||||
|
|
||||
|
assert.Equal(t, tt.wantErrCode, errCode, tt.description) |
||||
|
assert.True(t, checked, "Policy should be evaluated") |
||||
|
}) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// TestHasPolicyForBucket tests the HasPolicyForBucket method
|
||||
|
func TestHasPolicyForBucket(t *testing.T) { |
||||
|
engine := policy_engine.NewPolicyEngine() |
||||
|
|
||||
|
// Initially no policy
|
||||
|
assert.False(t, engine.HasPolicyForBucket("test-bucket")) |
||||
|
|
||||
|
// Set a policy
|
||||
|
policyJSON := `{ |
||||
|
"Version": "2012-10-17", |
||||
|
"Statement": [ |
||||
|
{ |
||||
|
"Effect": "Allow", |
||||
|
"Principal": "*", |
||||
|
"Action": "s3:GetObject", |
||||
|
"Resource": "arn:aws:s3:::test-bucket/*" |
||||
|
} |
||||
|
] |
||||
|
}` |
||||
|
err := engine.SetBucketPolicy("test-bucket", policyJSON) |
||||
|
require.NoError(t, err) |
||||
|
|
||||
|
// Now has policy
|
||||
|
assert.True(t, engine.HasPolicyForBucket("test-bucket")) |
||||
|
|
||||
|
// Other bucket still has no policy
|
||||
|
assert.False(t, engine.HasPolicyForBucket("other-bucket")) |
||||
|
|
||||
|
// Delete the policy
|
||||
|
err = engine.DeleteBucketPolicy("test-bucket") |
||||
|
require.NoError(t, err) |
||||
|
|
||||
|
// No longer has policy
|
||||
|
assert.False(t, engine.HasPolicyForBucket("test-bucket")) |
||||
|
} |
||||
|
|
||||
Write
Preview
Loading…
Cancel
Save
Reference in new issue