gsh-digital-services/seaweedFS
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

S3: Enforce bucket policy (#7471)

Browse Source 
* evaluate policies during authorization

* cache bucket policy

* refactor

* matching with regex special characters

* Case Sensitivity, pattern cache, Dead Code Removal

* Fixed Typo, Restored []string Case, Added Cache Size Limit

* hook up with policy engine

* remove old implementation

* action mapping

* validate

* if not specified, fall through to IAM checks

* fmt

* Fail-close on policy evaluation errors

* Explicit `Allow` bypasses IAM checks

* fix error message

* arn:seaweed => arn:aws

* remove legacy support

* fix tests

* Clean up bucket policy after this test

* fix for tests

* address comments

* security fixes

* fix tests

* temp comment out
This commit is contained in:
Chris Lu
2025-11-12 22:14:50 -08:00
committed by GitHub
parent 50f067bcfd
commit 508d06d9a5
47 changed files with 1104 additions and 749 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
test/s3/iam/test_config.json
View File

@@ -164,8 +164,8 @@
"Effect": "Allow",
"Action": ["s3:*"],
"Resource": [
"arn:seaweed:s3:::*",
"arn:seaweed:s3:::*/*"
"arn:aws:s3:::*",
"arn:aws:s3:::*/*"
]
}
]
@@ -184,8 +184,8 @@
"s3:GetBucketVersioning"
],
"Resource": [
"arn:seaweed:s3:::*",
"arn:seaweed:s3:::*/*"
"arn:aws:s3:::*",
"arn:aws:s3:::*/*"
]
}
]
@@ -207,7 +207,7 @@
"s3:ListMultipartUploadParts"
],
"Resource": [
"arn:seaweed:s3:::*/*"
"arn:aws:s3:::*/*"
]
}
]
@@ -227,7 +227,7 @@
"s3:PutBucketVersioning"
],
"Resource": [
"arn:seaweed:s3:::*"
"arn:aws:s3:::*"
]
}
]
@@ -239,8 +239,8 @@
"Effect": "Allow",
"Action": ["s3:*"],
"Resource": [
"arn:seaweed:s3:::*",
"arn:seaweed:s3:::*/*"
"arn:aws:s3:::*",
"arn:aws:s3:::*/*"
],
"Condition": {
"IpAddress": {
@@ -257,8 +257,8 @@
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": [
"arn:seaweed:s3:::*",
"arn:seaweed:s3:::*/*"
"arn:aws:s3:::*",
"arn:aws:s3:::*/*"
],
"Condition": {
"DateGreaterThan": {
@@ -281,7 +281,7 @@
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:seaweed:s3:::example-bucket/*"
"Resource": "arn:aws:s3:::example-bucket/*"
}
]
},
@@ -294,8 +294,8 @@
"Principal": "*",
"Action": ["s3:DeleteObject", "s3:DeleteBucket"],
"Resource": [
"arn:seaweed:s3:::example-bucket",
"arn:seaweed:s3:::example-bucket/*"
"arn:aws:s3:::example-bucket",
"arn:aws:s3:::example-bucket/*"
]
}
]
@@ -308,7 +308,7 @@
"Effect": "Allow",
"Principal": "*",
"Action": ["s3:GetObject", "s3:PutObject"],
"Resource": "arn:seaweed:s3:::example-bucket/*",
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": ["203.0.113.0/24"]