s3: change s3 tables to use RESTful API (#8169)

* s3: refactor s3 tables to use RESTful API * test/s3tables: guard empty namespaces * s3api: document tag parsing and validate get-table * s3api: limit S3Tables REST body size * Update weed/s3api/s3api_tables.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update weed/s3api/s3tables/handler.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * s3api: accept encoded table bucket ARNs * s3api: validate namespaces and close body * s3api: match encoded table bucket ARNs * s3api: scope table bucket ARN routes * s3api: dedupe table bucket request builders * test/s3tables: allow list tables without namespace * s3api: validate table params and tag ARN * s3api: tighten tag handling and get-table params * s3api: loosen tag ARN route matching * Fix S3 Tables REST routing and tests * Adjust S3 Tables request parsing * Gate S3 Tables target routing * Avoid double decoding namespaces --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-01-30 10:37:34 -08:00
parent 9e15823855
commit f1e27b8f30
7 changed files with 964 additions and 172 deletions
--- a/test/s3tables/client.go
+++ b/test/s3tables/client.go
@@ -2,15 +2,31 @@ package s3tables

 import (
 	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
+	"strconv"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"

 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
 )

-func (c *S3TablesClient) doRequest(operation string, body interface{}) (*http.Response, error) {
+func getFirstNamespace(namespace []string) (string, error) {
+	if len(namespace) == 0 {
+		return "", fmt.Errorf("namespace must not be empty")
+	}
+	return namespace[0], nil
+}
+
+func (c *S3TablesClient) doRestRequest(method, path string, body interface{}) (*http.Response, error) {
 	var bodyBytes []byte
 	var err error

@@ -21,19 +37,92 @@ func (c *S3TablesClient) doRequest(operation string, body interface{}) (*http.Re
 		}
 	}

-	req, err := http.NewRequest(http.MethodPost, c.endpoint, bytes.NewReader(bodyBytes))
+	req, err := http.NewRequest(method, c.endpoint+path, bytes.NewReader(bodyBytes))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create request: %w", err)
 	}

-	req.Header.Set("Content-Type", "application/x-amz-json-1.1")
-	req.Header.Set("X-Amz-Target", "S3Tables."+operation)
+	if body != nil {
+		req.Header.Set("Content-Type", "application/x-amz-json-1.1")
+	}
+
+	if err := c.signRequest(req, bodyBytes); err != nil {
+		return nil, err
+	}

 	return c.client.Do(req)
 }

-func (c *S3TablesClient) doRequestAndDecode(operation string, reqBody interface{}, respBody interface{}) error {
-	resp, err := c.doRequest(operation, reqBody)
+func (c *S3TablesClient) doTargetRequest(operation string, body interface{}) (*http.Response, error) {
+	var bodyBytes []byte
+	var err error
+
+	if body != nil {
+		bodyBytes, err = json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("failed to marshal request body: %w", err)
+		}
+	}
+
+	req, err := http.NewRequest(http.MethodPost, c.endpoint+"/", bytes.NewReader(bodyBytes))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.URL.RawPath = "/"
+	req.Header.Set("Content-Type", "application/x-amz-json-1.1")
+	req.Header.Set("X-Amz-Target", "S3Tables."+operation)
+
+	if err := c.signRequest(req, bodyBytes); err != nil {
+		return nil, err
+	}
+
+	return c.client.Do(req)
+}
+
+func (c *S3TablesClient) doTargetRequestAndDecode(operation string, reqBody interface{}, respBody interface{}) error {
+	resp, err := c.doTargetRequest(operation, reqBody)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		bodyBytes, readErr := io.ReadAll(resp.Body)
+		if readErr != nil {
+			return fmt.Errorf("%s failed with status %d and could not read error response body: %v", operation, resp.StatusCode, readErr)
+		}
+		var errResp s3tables.S3TablesError
+		if err := json.Unmarshal(bodyBytes, &errResp); err != nil {
+			return fmt.Errorf("%s failed with status %d, could not decode error response: %v. Body: %s", operation, resp.StatusCode, err, string(bodyBytes))
+		}
+		return fmt.Errorf("%s failed: %s - %s", operation, errResp.Type, errResp.Message)
+	}
+
+	if respBody != nil {
+		if err := json.NewDecoder(resp.Body).Decode(respBody); err != nil {
+			return fmt.Errorf("failed to decode %s response: %w", operation, err)
+		}
+	}
+
+	return nil
+}
+
+func (c *S3TablesClient) signRequest(req *http.Request, body []byte) error {
+	creds := aws.Credentials{
+		AccessKeyID:     c.accessKey,
+		SecretAccessKey: c.secretKey,
+	}
+	if req.Host == "" {
+		req.Host = req.URL.Host
+	}
+	req.Header.Set("Host", req.URL.Host)
+	payloadHash := sha256.Sum256(body)
+	return v4.NewSigner().SignHTTP(context.Background(), creds, req, hex.EncodeToString(payloadHash[:]), "s3tables", c.region, time.Now())
+}
+
+func (c *S3TablesClient) doRestRequestAndDecode(operation, method, path string, reqBody interface{}, respBody interface{}) error {
+	resp, err := c.doRestRequest(method, path, reqBody)
 	if err != nil {
 		return err
 	}
@@ -68,233 +157,275 @@ func (c *S3TablesClient) CreateTableBucket(name string, tags map[string]string)
 		Tags: tags,
 	}
 	var result s3tables.CreateTableBucketResponse
-	if err := c.doRequestAndDecode("CreateTableBucket", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("CreateTableBucket", http.MethodPut, "/buckets", req, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) GetTableBucket(arn string) (*s3tables.GetTableBucketResponse, error) {
-	req := &s3tables.GetTableBucketRequest{
-		TableBucketARN: arn,
-	}
+	path := "/buckets/" + url.PathEscape(arn)
 	var result s3tables.GetTableBucketResponse
-	if err := c.doRequestAndDecode("GetTableBucket", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("GetTableBucket", http.MethodGet, path, nil, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) ListTableBuckets(prefix, continuationToken string, maxBuckets int) (*s3tables.ListTableBucketsResponse, error) {
-	req := &s3tables.ListTableBucketsRequest{
-		Prefix:            prefix,
-		ContinuationToken: continuationToken,
-		MaxBuckets:        maxBuckets,
+	query := url.Values{}
+	if prefix != "" {
+		query.Set("prefix", prefix)
+	}
+	if continuationToken != "" {
+		query.Set("continuationToken", continuationToken)
+	}
+	if maxBuckets > 0 {
+		query.Set("maxBuckets", strconv.Itoa(maxBuckets))
+	}
+	path := "/buckets"
+	if encoded := query.Encode(); encoded != "" {
+		path = path + "?" + encoded
 	}
 	var result s3tables.ListTableBucketsResponse
-	if err := c.doRequestAndDecode("ListTableBuckets", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("ListTableBuckets", http.MethodGet, path, nil, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) DeleteTableBucket(arn string) error {
-	req := &s3tables.DeleteTableBucketRequest{
-		TableBucketARN: arn,
-	}
-	return c.doRequestAndDecode("DeleteTableBucket", req, nil)
+	path := "/buckets/" + url.PathEscape(arn)
+	return c.doRestRequestAndDecode("DeleteTableBucket", http.MethodDelete, path, nil, nil)
 }

 // Namespace operations

 func (c *S3TablesClient) CreateNamespace(bucketARN string, namespace []string) (*s3tables.CreateNamespaceResponse, error) {
-	req := &s3tables.CreateNamespaceRequest{
-		TableBucketARN: bucketARN,
-		Namespace:      namespace,
+	if len(namespace) == 0 {
+		return nil, fmt.Errorf("CreateNamespace requires namespace")
 	}
+	req := &s3tables.CreateNamespaceRequest{
+		Namespace: namespace,
+	}
+	path := "/namespaces/" + url.PathEscape(bucketARN)
 	var result s3tables.CreateNamespaceResponse
-	if err := c.doRequestAndDecode("CreateNamespace", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("CreateNamespace", http.MethodPut, path, req, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) GetNamespace(bucketARN string, namespace []string) (*s3tables.GetNamespaceResponse, error) {
-	req := &s3tables.GetNamespaceRequest{
-		TableBucketARN: bucketARN,
-		Namespace:      namespace,
+	name, err := getFirstNamespace(namespace)
+	if err != nil {
+		return nil, fmt.Errorf("GetNamespace requires namespace: %w", err)
 	}
+	path := "/namespaces/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(name)
 	var result s3tables.GetNamespaceResponse
-	if err := c.doRequestAndDecode("GetNamespace", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("GetNamespace", http.MethodGet, path, nil, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) ListNamespaces(bucketARN, prefix, continuationToken string, maxNamespaces int) (*s3tables.ListNamespacesResponse, error) {
-	req := &s3tables.ListNamespacesRequest{
-		TableBucketARN:    bucketARN,
-		Prefix:            prefix,
-		ContinuationToken: continuationToken,
-		MaxNamespaces:     maxNamespaces,
+	query := url.Values{}
+	if prefix != "" {
+		query.Set("prefix", prefix)
+	}
+	if continuationToken != "" {
+		query.Set("continuationToken", continuationToken)
+	}
+	if maxNamespaces > 0 {
+		query.Set("maxNamespaces", strconv.Itoa(maxNamespaces))
+	}
+	path := "/namespaces/" + url.PathEscape(bucketARN)
+	if encoded := query.Encode(); encoded != "" {
+		path = path + "?" + encoded
 	}
 	var result s3tables.ListNamespacesResponse
-	if err := c.doRequestAndDecode("ListNamespaces", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("ListNamespaces", http.MethodGet, path, nil, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) DeleteNamespace(bucketARN string, namespace []string) error {
-	req := &s3tables.DeleteNamespaceRequest{
-		TableBucketARN: bucketARN,
-		Namespace:      namespace,
+	name, err := getFirstNamespace(namespace)
+	if err != nil {
+		return fmt.Errorf("DeleteNamespace requires namespace: %w", err)
 	}
-	return c.doRequestAndDecode("DeleteNamespace", req, nil)
+	path := "/namespaces/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(name)
+	return c.doRestRequestAndDecode("DeleteNamespace", http.MethodDelete, path, nil, nil)
 }

 // Table operations

 func (c *S3TablesClient) CreateTable(bucketARN string, namespace []string, name, format string, metadata *s3tables.TableMetadata, tags map[string]string) (*s3tables.CreateTableResponse, error) {
-	req := &s3tables.CreateTableRequest{
-		TableBucketARN: bucketARN,
-		Namespace:      namespace,
-		Name:           name,
-		Format:         format,
-		Metadata:       metadata,
-		Tags:           tags,
+	nameSpace, err := getFirstNamespace(namespace)
+	if err != nil {
+		return nil, fmt.Errorf("CreateTable requires namespace: %w", err)
 	}
+	req := &s3tables.CreateTableRequest{
+		Name:     name,
+		Format:   format,
+		Metadata: metadata,
+		Tags:     tags,
+	}
+	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(nameSpace)
 	var result s3tables.CreateTableResponse
-	if err := c.doRequestAndDecode("CreateTable", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("CreateTable", http.MethodPut, path, req, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) GetTable(bucketARN string, namespace []string, name string) (*s3tables.GetTableResponse, error) {
-	req := &s3tables.GetTableRequest{
-		TableBucketARN: bucketARN,
-		Namespace:      namespace,
-		Name:           name,
+	nameSpace, err := getFirstNamespace(namespace)
+	if err != nil {
+		return nil, fmt.Errorf("GetTable requires namespace: %w", err)
 	}
+	query := url.Values{}
+	query.Set("tableBucketARN", bucketARN)
+	query.Set("namespace", nameSpace)
+	query.Set("name", name)
+	path := "/get-table?" + query.Encode()
 	var result s3tables.GetTableResponse
-	if err := c.doRequestAndDecode("GetTable", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("GetTable", http.MethodGet, path, nil, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) ListTables(bucketARN string, namespace []string, prefix, continuationToken string, maxTables int) (*s3tables.ListTablesResponse, error) {
-	req := &s3tables.ListTablesRequest{
-		TableBucketARN:    bucketARN,
-		Namespace:         namespace,
-		Prefix:            prefix,
-		ContinuationToken: continuationToken,
-		MaxTables:         maxTables,
+	query := url.Values{}
+	if len(namespace) > 0 {
+		nameSpace, err := getFirstNamespace(namespace)
+		if err != nil {
+			return nil, fmt.Errorf("ListTables requires namespace: %w", err)
+		}
+		query.Set("namespace", nameSpace)
+	}
+	if prefix != "" {
+		query.Set("prefix", prefix)
+	}
+	if continuationToken != "" {
+		query.Set("continuationToken", continuationToken)
+	}
+	if maxTables > 0 {
+		query.Set("maxTables", strconv.Itoa(maxTables))
+	}
+	path := "/tables/" + url.PathEscape(bucketARN)
+	if encoded := query.Encode(); encoded != "" {
+		path = path + "?" + encoded
 	}
 	var result s3tables.ListTablesResponse
-	if err := c.doRequestAndDecode("ListTables", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("ListTables", http.MethodGet, path, nil, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) DeleteTable(bucketARN string, namespace []string, name string) error {
-	req := &s3tables.DeleteTableRequest{
-		TableBucketARN: bucketARN,
-		Namespace:      namespace,
-		Name:           name,
+	nameSpace, err := getFirstNamespace(namespace)
+	if err != nil {
+		return fmt.Errorf("DeleteTable requires namespace: %w", err)
 	}
-	return c.doRequestAndDecode("DeleteTable", req, nil)
+	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(nameSpace) + "/" + url.PathEscape(name)
+	return c.doRestRequestAndDecode("DeleteTable", http.MethodDelete, path, nil, nil)
 }

 // Policy operations

 func (c *S3TablesClient) PutTableBucketPolicy(bucketARN, policy string) error {
 	req := &s3tables.PutTableBucketPolicyRequest{
-		TableBucketARN: bucketARN,
 		ResourcePolicy: policy,
 	}
-	return c.doRequestAndDecode("PutTableBucketPolicy", req, nil)
+	path := "/buckets/" + url.PathEscape(bucketARN) + "/policy"
+	return c.doRestRequestAndDecode("PutTableBucketPolicy", http.MethodPut, path, req, nil)
 }

 func (c *S3TablesClient) GetTableBucketPolicy(bucketARN string) (*s3tables.GetTableBucketPolicyResponse, error) {
-	req := &s3tables.GetTableBucketPolicyRequest{
-		TableBucketARN: bucketARN,
-	}
+	path := "/buckets/" + url.PathEscape(bucketARN) + "/policy"
 	var result s3tables.GetTableBucketPolicyResponse
-	if err := c.doRequestAndDecode("GetTableBucketPolicy", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("GetTableBucketPolicy", http.MethodGet, path, nil, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) DeleteTableBucketPolicy(bucketARN string) error {
-	req := &s3tables.DeleteTableBucketPolicyRequest{
-		TableBucketARN: bucketARN,
-	}
-	return c.doRequestAndDecode("DeleteTableBucketPolicy", req, nil)
+	path := "/buckets/" + url.PathEscape(bucketARN) + "/policy"
+	return c.doRestRequestAndDecode("DeleteTableBucketPolicy", http.MethodDelete, path, nil, nil)
 }

 // Table Policy operations

 func (c *S3TablesClient) PutTablePolicy(bucketARN string, namespace []string, name, policy string) error {
+	nameSpace, err := getFirstNamespace(namespace)
+	if err != nil {
+		return fmt.Errorf("PutTablePolicy requires namespace: %w", err)
+	}
 	req := &s3tables.PutTablePolicyRequest{
-		TableBucketARN: bucketARN,
-		Namespace:      namespace,
-		Name:           name,
 		ResourcePolicy: policy,
 	}
-	return c.doRequestAndDecode("PutTablePolicy", req, nil)
+	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(nameSpace) + "/" + url.PathEscape(name) + "/policy"
+	return c.doRestRequestAndDecode("PutTablePolicy", http.MethodPut, path, req, nil)
 }

 func (c *S3TablesClient) GetTablePolicy(bucketARN string, namespace []string, name string) (*s3tables.GetTablePolicyResponse, error) {
-	req := &s3tables.GetTablePolicyRequest{
-		TableBucketARN: bucketARN,
-		Namespace:      namespace,
-		Name:           name,
+	nameSpace, err := getFirstNamespace(namespace)
+	if err != nil {
+		return nil, fmt.Errorf("GetTablePolicy requires namespace: %w", err)
 	}
+	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(nameSpace) + "/" + url.PathEscape(name) + "/policy"
 	var result s3tables.GetTablePolicyResponse
-	if err := c.doRequestAndDecode("GetTablePolicy", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("GetTablePolicy", http.MethodGet, path, nil, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) DeleteTablePolicy(bucketARN string, namespace []string, name string) error {
-	req := &s3tables.DeleteTablePolicyRequest{
-		TableBucketARN: bucketARN,
-		Namespace:      namespace,
-		Name:           name,
+	nameSpace, err := getFirstNamespace(namespace)
+	if err != nil {
+		return fmt.Errorf("DeleteTablePolicy requires namespace: %w", err)
 	}
-	return c.doRequestAndDecode("DeleteTablePolicy", req, nil)
+	path := "/tables/" + url.PathEscape(bucketARN) + "/" + url.PathEscape(nameSpace) + "/" + url.PathEscape(name) + "/policy"
+	return c.doRestRequestAndDecode("DeleteTablePolicy", http.MethodDelete, path, nil, nil)
 }

 // Tagging operations

 func (c *S3TablesClient) TagResource(resourceARN string, tags map[string]string) error {
 	req := &s3tables.TagResourceRequest{
-		ResourceARN: resourceARN,
-		Tags:        tags,
+		Tags: tags,
 	}
-	return c.doRequestAndDecode("TagResource", req, nil)
+	path := "/tag/" + url.PathEscape(resourceARN)
+	return c.doRestRequestAndDecode("TagResource", http.MethodPost, path, req, nil)
 }

 func (c *S3TablesClient) ListTagsForResource(resourceARN string) (*s3tables.ListTagsForResourceResponse, error) {
-	req := &s3tables.ListTagsForResourceRequest{
-		ResourceARN: resourceARN,
-	}
+	path := "/tag/" + url.PathEscape(resourceARN)
 	var result s3tables.ListTagsForResourceResponse
-	if err := c.doRequestAndDecode("ListTagsForResource", req, &result); err != nil {
+	if err := c.doRestRequestAndDecode("ListTagsForResource", http.MethodGet, path, nil, &result); err != nil {
 		return nil, err
 	}
 	return &result, nil
 }

 func (c *S3TablesClient) UntagResource(resourceARN string, tagKeys []string) error {
-	req := &s3tables.UntagResourceRequest{
-		ResourceARN: resourceARN,
-		TagKeys:     tagKeys,
+	if len(tagKeys) == 0 {
+		return fmt.Errorf("tagKeys cannot be empty")
 	}
-	return c.doRequestAndDecode("UntagResource", req, nil)
+	query := url.Values{}
+	for _, key := range tagKeys {
+		query.Add("tagKeys", key)
+	}
+	path := "/tag/" + url.PathEscape(resourceARN)
+	if encoded := query.Encode(); encoded != "" {
+		path = path + "?" + encoded
+	}
+	return c.doRestRequestAndDecode("UntagResource", http.MethodDelete, path, nil, nil)
 }
--- a/test/s3tables/s3tables_integration_test.go
+++ b/test/s3tables/s3tables_integration_test.go
@@ -64,6 +64,10 @@ func TestS3TablesIntegration(t *testing.T) {
 	t.Run("Tagging", func(t *testing.T) {
 		testTagging(t, client)
 	})
+
+	t.Run("TargetOperations", func(t *testing.T) {
+		testTargetOperations(t, client)
+	})
 }

 func testTableBucketLifecycle(t *testing.T, client *S3TablesClient) {
@@ -355,6 +359,125 @@ func testTagging(t *testing.T, client *S3TablesClient) {
 	t.Logf("✓ Verified tag removal")
 }

+func testTargetOperations(t *testing.T, client *S3TablesClient) {
+	bucketName := "test-target-bucket-" + randomString(8)
+
+	var createResp s3tables.CreateTableBucketResponse
+	err := client.doTargetRequestAndDecode("CreateTableBucket", &s3tables.CreateTableBucketRequest{
+		Name: bucketName,
+	}, &createResp)
+	require.NoError(t, err, "Failed to create table bucket via target")
+	defer client.doTargetRequestAndDecode("DeleteTableBucket", &s3tables.DeleteTableBucketRequest{
+		TableBucketARN: createResp.ARN,
+	}, nil)
+
+	var listResp s3tables.ListTableBucketsResponse
+	err = client.doTargetRequestAndDecode("ListTableBuckets", &s3tables.ListTableBucketsRequest{}, &listResp)
+	require.NoError(t, err, "Failed to list table buckets via target")
+	found := false
+	for _, b := range listResp.TableBuckets {
+		if b.Name == bucketName {
+			found = true
+			break
+		}
+	}
+	assert.True(t, found, "Created bucket should appear in target list")
+
+	var getResp s3tables.GetTableBucketResponse
+	err = client.doTargetRequestAndDecode("GetTableBucket", &s3tables.GetTableBucketRequest{
+		TableBucketARN: createResp.ARN,
+	}, &getResp)
+	require.NoError(t, err, "Failed to get table bucket via target")
+	assert.Equal(t, bucketName, getResp.Name)
+
+	namespaceName := "target_ns"
+	var createNsResp s3tables.CreateNamespaceResponse
+	err = client.doTargetRequestAndDecode("CreateNamespace", &s3tables.CreateNamespaceRequest{
+		TableBucketARN: createResp.ARN,
+		Namespace:      []string{namespaceName},
+	}, &createNsResp)
+	require.NoError(t, err, "Failed to create namespace via target")
+	defer client.doTargetRequestAndDecode("DeleteNamespace", &s3tables.DeleteNamespaceRequest{
+		TableBucketARN: createResp.ARN,
+		Namespace:      []string{namespaceName},
+	}, nil)
+
+	var listNsResp s3tables.ListNamespacesResponse
+	err = client.doTargetRequestAndDecode("ListNamespaces", &s3tables.ListNamespacesRequest{
+		TableBucketARN: createResp.ARN,
+	}, &listNsResp)
+	require.NoError(t, err, "Failed to list namespaces via target")
+
+	tableName := "target_table"
+	var createTableResp s3tables.CreateTableResponse
+	err = client.doTargetRequestAndDecode("CreateTable", &s3tables.CreateTableRequest{
+		TableBucketARN: createResp.ARN,
+		Namespace:      []string{namespaceName},
+		Name:           tableName,
+		Format:         "ICEBERG",
+	}, &createTableResp)
+	require.NoError(t, err, "Failed to create table via target")
+	defer client.doTargetRequestAndDecode("DeleteTable", &s3tables.DeleteTableRequest{
+		TableBucketARN: createResp.ARN,
+		Namespace:      []string{namespaceName},
+		Name:           tableName,
+	}, nil)
+
+	var listTablesResp s3tables.ListTablesResponse
+	err = client.doTargetRequestAndDecode("ListTables", &s3tables.ListTablesRequest{
+		TableBucketARN: createResp.ARN,
+		Namespace:      []string{namespaceName},
+	}, &listTablesResp)
+	require.NoError(t, err, "Failed to list tables via target")
+
+	var getTableResp s3tables.GetTableResponse
+	err = client.doTargetRequestAndDecode("GetTable", &s3tables.GetTableRequest{
+		TableBucketARN: createResp.ARN,
+		Namespace:      []string{namespaceName},
+		Name:           tableName,
+	}, &getTableResp)
+	require.NoError(t, err, "Failed to get table via target")
+	assert.Equal(t, tableName, getTableResp.Name)
+
+	policy := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3tables:*","Resource":"*"}]}`
+	err = client.doTargetRequestAndDecode("PutTableBucketPolicy", &s3tables.PutTableBucketPolicyRequest{
+		TableBucketARN: createResp.ARN,
+		ResourcePolicy: policy,
+	}, nil)
+	require.NoError(t, err, "Failed to put bucket policy via target")
+
+	var getPolicyResp s3tables.GetTableBucketPolicyResponse
+	err = client.doTargetRequestAndDecode("GetTableBucketPolicy", &s3tables.GetTableBucketPolicyRequest{
+		TableBucketARN: createResp.ARN,
+	}, &getPolicyResp)
+	require.NoError(t, err, "Failed to get bucket policy via target")
+	assert.Equal(t, policy, getPolicyResp.ResourcePolicy)
+
+	err = client.doTargetRequestAndDecode("DeleteTableBucketPolicy", &s3tables.DeleteTableBucketPolicyRequest{
+		TableBucketARN: createResp.ARN,
+	}, nil)
+	require.NoError(t, err, "Failed to delete bucket policy via target")
+
+	err = client.doTargetRequestAndDecode("TagResource", &s3tables.TagResourceRequest{
+		ResourceARN: createResp.ARN,
+		Tags:        map[string]string{"Environment": "test"},
+	}, nil)
+	require.NoError(t, err, "Failed to tag resource via target")
+
+	var listTagsResp s3tables.ListTagsForResourceResponse
+	err = client.doTargetRequestAndDecode("ListTagsForResource", &s3tables.ListTagsForResourceRequest{
+		ResourceARN: createResp.ARN,
+	}, &listTagsResp)
+	require.NoError(t, err, "Failed to list tags via target")
+	assert.Equal(t, "test", listTagsResp.Tags["Environment"])
+
+	err = client.doTargetRequestAndDecode("UntagResource", &s3tables.UntagResourceRequest{
+		ResourceARN: createResp.ARN,
+		TagKeys:     []string{"Environment"},
+	}, nil)
+	require.NoError(t, err, "Failed to untag resource via target")
+}
+
 // Helper functions

 // findAvailablePort finds an available port by binding to port 0