gsh-digital-services/seaweedFS
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(s3): apply PutObject multipart expansion to STS session policies (#8932)

Browse Source 
* fix(s3): apply PutObject multipart expansion to STS session policy evaluation (#8929)

PR #8445 added logic to implicitly grant multipart upload actions when
s3:PutObject is authorized, but only in the S3 API policy engine's
CompiledStatement.MatchesAction(). STS session policies are evaluated
through the IAM policy engine's matchesActions() -> awsIAMMatch() path,
which did plain pattern matching without the multipart expansion.

Add the same multipart expansion logic to the IAM policy engine's
matchesActions() so that session policies containing s3:PutObject
correctly allow multipart upload operations.

* fix: make multipart action set lookup case-insensitive and optimize

Address PR review feedback:
- Lowercase multipartActionSet keys and use strings.ToLower for lookup,
  since AWS IAM actions are case-insensitive
- Only check for s3:PutObject permission when the requested action is
  actually a multipart action, avoiding unnecessary awsIAMMatch calls
- Add test case for case-insensitive multipart action matching
This commit is contained in:
Chris Lu
2026-04-05 14:06:50 -07:00
committed by GitHub
parent 69cd5fa37b
commit b8fc99a9cd
2 changed files with 106 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
weed/iam/policy/policy_engine.go
View File

@@ -600,12 +600,31 @@ func (e *PolicyEngine) statementMatches(statement *Statement, evalCtx *Evaluatio
return true
}
// matchesActions checks if any action in the list matches the requested action
// multipartActionSet contains lowercased S3 multipart upload actions that are
// implicitly granted when s3:PutObject is allowed, since multipart upload is an
// implementation detail of putting objects. Keys are lowercased for
// case-insensitive lookup (AWS IAM actions are case-insensitive).
var multipartActionSet = map[string]bool{
"s3:createmultipartupload": true,
"s3:uploadpart": true,
"s3:completemultipartupload": true,
"s3:abortmultipartupload": true,
"s3:listmultipartuploadparts": true,
"s3:listbucketmultipartuploads": true,
}
// matchesActions checks if any action in the list matches the requested action.
// It also implicitly grants multipart upload actions when s3:PutObject is allowed,
// mirroring the behavior in the S3 API policy engine (see PR #8445).
func (e *PolicyEngine) matchesActions(actions []string, requestedAction string, evalCtx *EvaluationContext) bool {
isMultipart := multipartActionSet[strings.ToLower(requestedAction)]
for _, action := range actions {
if awsIAMMatch(action, requestedAction, evalCtx) {
return true
}
if isMultipart && awsIAMMatch(action, "s3:PutObject", evalCtx) {
return true
}
}
return false
}