* feat: Implement IAM managed policy operations (GetPolicy, ListPolicies, DeletePolicy, AttachUserPolicy, DetachUserPolicy)
- Add response type aliases in iamapi_response.go for managed policy operations
- Implement 6 handler methods in iamapi_management_handlers.go:
- GetPolicy: Lookup managed policy by ARN
- DeletePolicy: Remove managed policy
- ListPolicies: List all managed policies
- AttachUserPolicy: Attach managed policy to user, aggregating inline + managed actions
- DetachUserPolicy: Detach managed policy from user
- ListAttachedUserPolicies: List user's attached managed policies
- Add computeAllActionsForUser() to aggregate actions from both inline and managed policies
- Wire 6 new DoActions switch cases for policy operations
- Add comprehensive tests for all new handlers
- Fixes#8506
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address PR review feedback for IAM managed policy operations
- Add parsePolicyArn() helper with proper ARN prefix validation, replacing
fragile strings.Split parsing in GetPolicy, DeletePolicy, AttachUserPolicy,
and DetachUserPolicy
- DeletePolicy now detaches the policy from all users and recomputes their
aggregated actions, preventing stale permissions after deletion
- Set changed=true for DeletePolicy DoActions case so identity updates persist
- Make PolicyId consistent: CreatePolicy now uses Hash(&policyName) matching
GetPolicy and ListPolicies
- Remove redundant nil map checks (Go handles nil map lookups safely)
- DRY up action deduplication in computeAllActionsForUser with addUniqueActions
closure
- Add tests for invalid/empty ARN rejection and DeletePolicy identity cleanup
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add integration tests for managed policy lifecycle (#8506)
Add two integration tests covering the user-reported use case where
managed policy operations returned 500 errors:
- TestS3IAMManagedPolicyLifecycle: end-to-end workflow matching the
issue report — CreatePolicy, ListPolicies, GetPolicy, AttachUserPolicy,
ListAttachedUserPolicies, idempotent re-attach, DeletePolicy while
attached (expects DeleteConflict), DetachUserPolicy, DeletePolicy,
and verification that deleted policy is gone
- TestS3IAMManagedPolicyErrorCases: covers error paths — nonexistent
policy/user for GetPolicy, DeletePolicy, AttachUserPolicy,
DetachUserPolicy, and ListAttachedUserPolicies
Also fixes DeletePolicy to reject deletion when policy is still attached
to a user (AWS-compatible DeleteConflictException), and adds the 409
status code mapping for DeleteConflictException in the error response
handler.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: nil map panic in CreatePolicy, add PolicyId test assertions
- Initialize policies.Policies map in CreatePolicy if nil (prevents panic
when no policies exist yet); also handle filer_pb.ErrNotFound like other
callers
- Add PolicyId assertions in TestGetPolicy and TestListPolicies to lock in
the consistent Hash(&policyName) behavior
- Remove redundant time.Sleep calls from new integration tests (startMiniCluster
already blocks on waitForS3Ready)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: PutUserPolicy and DeleteUserPolicy now preserve managed policy actions
PutUserPolicy and DeleteUserPolicy were calling computeAggregatedActionsForUser
(inline-only), overwriting ident.Actions and dropping managed policy actions.
Both now call computeAllActionsForUser which unions inline + managed actions.
Add TestManagedPolicyActionsPreservedAcrossInlineMutations regression test:
attaches a managed policy, adds an inline policy (verifies both actions present),
deletes the inline policy, then asserts managed policy actions still persist.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: PutUserPolicy verifies user exists before persisting inline policy
Previously the inline policy was written to storage before checking if the
target user exists in s3cfg.Identities, leaving orphaned policy data when
the user was absent. Now validates the user first, returning
NoSuchEntityException immediately if not found.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: prevent stale/lost actions on computeAllActionsForUser failure
- PutUserPolicy: on recomputation failure, preserve existing ident.Actions
instead of falling back to only the current inline policy's actions
- DeleteUserPolicy: on recomputation failure, preserve existing ident.Actions
instead of assigning nil (which wiped all permissions)
- AttachUserPolicy: roll back ident.PolicyNames and return error if
action recomputation fails, keeping identity consistent
- DetachUserPolicy: roll back ident.PolicyNames and return error if
GetPolicies or action recomputation fails
- Add doc comment on newTestIamApiServer noting it only sets s3ApiConfig
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Fix IAM inline user policy retrieval
* fmt
* Persist inline user policies to avoid loss on server restart
- Use s3ApiConfig.PutPolicies/GetPolicies for persistent storage instead of non-persistent global map
- Remove unused global policyDocuments map
- Update PutUserPolicy to store policies in persistent storage
- Update GetUserPolicy to read from persistent storage
- Update DeleteUserPolicy to clean up persistent storage
- Add mock IamS3ApiConfig for testing
- Improve test to verify policy statements are not merged or lost
* Fix inline policy key collision and action aggregation
* Improve error handling and optimize inline policy management
- GetUserPolicy: Propagate GetPolicies errors instead of silently falling through
- DeleteUserPolicy: Return error immediately on GetPolicies failure
- computeAggregatedActionsForUser: Add optional Policies parameter for I/O optimization
- PutUserPolicy: Reuse fetched policies to avoid redundant GetPolicies call
- Improve logging with clearer messages about best-effort aggregation
- Update test to use exact action string matching instead of substring checks
All 15 tests pass with no regressions.
* Add per-user policy index for O(1) lookup performance
- Extend Policies struct with InlinePolicies map[userName]map[policyName]
- Add getOrCreateUserPolicies() helper for safe user map management
- Update computeAggregatedActionsForUser to use direct user map access
- Update PutUserPolicy, GetUserPolicy, DeleteUserPolicy for new structure
- Performance: O(1) user lookups instead of O(all_policies) iteration
- Eliminates string prefix matching loop
- All tests pass; backward compatible with managed policies
* Fix DeleteUserPolicy to validate user existence before storage modification
Refactor DeleteUserPolicy handler to check user existence early:
- First iterate s3cfg.Identities to verify user exists
- Return NoSuchEntity error immediately if user not found
- Only then proceed with GetPolicies and policy deletion
- Capture reference to found identity for direct update
This ensures consistency: if user doesn't exist, storage is not modified.
Previously the code would delete from storage first and check identity
afterwards, potentially leaving orphaned policies.
Benefits:
- Fail-fast validation before storage operations
- No orphaned policies in storage if validation fails
- Atomic from logical perspective
- Direct identity reference eliminates redundant loop
- All error paths preserved and tested
All 15 tests pass; no functional changes to behavior.
* Fix GetUserPolicy to return NoSuchEntity when inline policy not found
When InlinePolicies[userName] exists but does not contain policyName,
the handler now immediately returns NoSuchEntity error instead of
falling through to the reconstruction logic.
Changes:
- Add else clause after userPolicies[policyName] lookup
- Return IamError(NoSuchEntityException, "policy not found") immediately
- Prevents incorrect fallback to reconstructing ident.Actions
- Ensures explicit error when policy explicitly doesn't exist
This improves error semantics:
- Policy exists in stored inline policies → return error (not reconstruct)
- Policy doesn't exist in stored inline policies → try reconstruction (backward compat)
- Storage error → return service failure error
All 15 tests pass; no behavioral changes to existing error or success paths.
This resolves GitHub issue #7747 by extracting duplicated IAM code into
a shared package that both the embedded S3 IAM and standalone IAM use.
New shared package (weed/iam/):
- constants.go: Common constants (charsets, action strings, error messages)
- helpers.go: Shared helper functions (Hash, GenerateRandomString,
GenerateAccessKeyId, GenerateSecretAccessKey, StringSlicesEqual,
MapToStatementAction, MapToIdentitiesAction, MaskAccessKey)
- responses.go: Common IAM response structs (CommonResponse, ListUsersResponse,
CreateUserResponse, etc.)
- helpers_test.go: Unit tests for shared helpers
Updated files:
- weed/s3api/s3api_embedded_iam.go: Use type aliases and function wrappers
to the shared package, removing ~200 lines of duplicated code
- weed/iamapi/iamapi_management_handlers.go: Use shared package for constants
and helper functions, removing ~100 lines of duplicated code
- weed/iamapi/iamapi_response.go: Re-export types from shared package for
backwards compatibility
Benefits:
- Single source of truth for IAM constants and helpers
- Easier maintenance - changes only need to be made in one place
- Reduced risk of inconsistencies between embedded and standalone IAM
- Better test coverage through shared test suite
* Embed IAM API into S3 server
This change simplifies the S3 and IAM deployment by embedding the IAM API
directly into the S3 server, following the patterns used by MinIO and Ceph RGW.
Changes:
- Add -iam flag to S3 server (enabled by default)
- Create embedded IAM API handler in s3api package
- Register IAM routes (POST to /) in S3 server when enabled
- Deprecate standalone 'weed iam' command with warning
Benefits:
- Single binary, single port for both S3 and IAM APIs
- Simpler deployment and configuration
- Shared credential manager between S3 and IAM
- Backward compatible: 'weed iam' still works with deprecation warning
Usage:
- weed s3 -port=8333 # S3 + IAM on same port (default)
- weed s3 -iam=false # S3 only, disable embedded IAM
- weed iam -port=8111 # Deprecated, shows warning
* Fix nil pointer panic: add s3.iam flag to weed server command
The enableIam field was not initialized when running S3 via 'weed server',
causing a nil pointer dereference when checking *s3opt.enableIam.
* Fix nil pointer panic: add s3.iam flag to weed filer command
The enableIam field was not initialized when running S3 via 'weed filer -s3',
causing a nil pointer dereference when checking *s3opt.enableIam.
* Add integration tests for embedded IAM API
Tests cover:
- CreateUser, ListUsers, GetUser, UpdateUser, DeleteUser
- CreateAccessKey, DeleteAccessKey, ListAccessKeys
- CreatePolicy, PutUserPolicy, GetUserPolicy
- Implicit username extraction from authorization header
- Full user lifecycle workflow test
These tests validate the embedded IAM API functionality that was
added in the S3 server, ensuring IAM operations work correctly
when served from the same port as S3.
* Security: Use crypto/rand for IAM credential generation
SECURITY FIX: Replace math/rand with crypto/rand for generating
access keys and secret keys.
Using math/rand is not cryptographically secure and can lead to
predictable credentials. This change:
1. Replaces math/rand with crypto/rand in both:
- weed/s3api/s3api_embedded_iam.go (embedded IAM)
- weed/iamapi/iamapi_management_handlers.go (standalone IAM)
2. Removes the seededRand variable that was initialized with
time-based seed (predictable)
3. Updates StringWithCharset/iamStringWithCharset to:
- Use crypto/rand.Int() for secure random index generation
- Return an error for proper error handling
4. Updates CreateAccessKey to handle the new error return
5. Updates DoActions handlers to propagate errors properly
* Fix critical bug: DeleteUserPolicy was deleting entire user instead of policy
BUG FIX: DeleteUserPolicy was incorrectly deleting the entire user
identity from s3cfg.Identities instead of just clearing the user's
inline policy (Actions).
Before (wrong):
s3cfg.Identities = append(s3cfg.Identities[:i], s3cfg.Identities[i+1:]...)
After (correct):
ident.Actions = nil
Also:
- Added proper iamDeleteUserPolicyResponse / DeleteUserPolicyResponse types
- Fixed return type from iamPutUserPolicyResponse to iamDeleteUserPolicyResponse
Affected files:
- weed/s3api/s3api_embedded_iam.go (embedded IAM)
- weed/iamapi/iamapi_management_handlers.go (standalone IAM)
- weed/iamapi/iamapi_response.go (response types)
* Add tests for DeleteUserPolicy to prevent regression
Added two tests:
1. TestEmbeddedIamDeleteUserPolicy - Verifies that:
- User is NOT deleted (identity still exists)
- Credentials are NOT deleted
- Only Actions (policy) are cleared to nil
2. TestEmbeddedIamDeleteUserPolicyUserNotFound - Verifies:
- Returns 404 when user doesn't exist
These tests ensure the bug fixed in the previous commit
(deleting user instead of policy) doesn't regress.
* Fix race condition: Add mutex lock to IAM DoActions
The DoActions function performs a read-modify-write operation on the
shared IAM configuration without any locking. This could lead to race
conditions and data loss if multiple requests modify the IAM config
concurrently.
Added mutex lock at the start of DoActions in both:
- weed/s3api/s3api_embedded_iam.go (embedded IAM)
- weed/iamapi/iamapi_management_handlers.go (standalone IAM)
The lock protects the entire read-modify-write cycle:
1. GetS3ApiConfiguration (read)
2. Modify s3cfg based on action
3. PutS3ApiConfiguration (write)
* Fix action comparison and document CreatePolicy limitation
1. Replace reflect.DeepEqual with order-independent string slice comparison
- Added iamStringSlicesEqual/stringSlicesEqual helper functions
- Prevents duplicate policy statements when actions are in different order
2. Document CreatePolicy limitation in embedded IAM
- Added TODO comment explaining that managed policies are not persisted
- Users should use PutUserPolicy for inline policies
3. Fix deadlock in standalone IAM's CreatePolicy
- Removed nested lock acquisition (DoActions already holds the lock)
Files changed:
- weed/s3api/s3api_embedded_iam.go
- weed/iamapi/iamapi_management_handlers.go
* Add rate limiting to embedded IAM endpoint
Apply circuit breaker rate limiting to the IAM endpoint to prevent abuse.
Also added request tracking for IAM operations.
The IAM endpoint now follows the same pattern as other S3 endpoints:
- track() for request metrics
- s3a.iam.Auth() for authentication
- s3a.cb.Limit() for rate limiting
* Fix handleImplicitUsername to properly look up username from AccessKeyId
According to AWS spec, when UserName is not specified in an IAM request,
IAM should determine the username implicitly based on the AccessKeyId
signing the request.
Previously, the code incorrectly extracted s[2] (region field) from the
SigV4 credential string as the username. This fix:
1. Extracts the AccessKeyId from s[0] of the credential string
2. Looks up the AccessKeyId in the credential store using LookupByAccessKey
3. Uses the identity's Name field as the username if found
Also:
- Added exported LookupByAccessKey wrapper method to IdentityAccessManagement
- Updated tests to verify correct access key lookup behavior
- Applied fix to both embedded IAM and standalone IAM implementations
* Fix CreatePolicy to not trigger unnecessary save
CreatePolicy validates the policy document and returns metadata but does not
actually store the policy (SeaweedFS uses inline policies attached via
PutUserPolicy). However, 'changed' was left as true, triggering an unnecessary
save operation.
Set changed = false after successful CreatePolicy validation in both embedded
IAM and standalone IAM implementations.
* Improve embedded IAM test quality
- Remove unused mock types (mockCredentialManager, mockEmbeddedIamApi)
- Use proto.Clone instead of proto.Merge for proper deep copy semantics
- Replace brittle regex-based XML error extraction with proper XML unmarshalling
- Remove unused regexp import
- Add state and field assertions to tests:
- CreateUser: verify username in response and user persisted in config
- ListUsers: verify response contains expected users
- GetUser: verify username in response
- CreatePolicy: verify policy metadata in response
- PutUserPolicy: verify actions were attached to user
- CreateAccessKey: verify credentials in response and persisted in config
* Remove shared test state and improve executeEmbeddedIamRequest
- Remove package-level embeddedIamApi variable to avoid shared test state
- Update executeEmbeddedIamRequest to accept API instance as parameter
- Only call xml.Unmarshal when v != nil, making nil-v cases explicit
- Return unmarshal error properly instead of always returning it
- Update all tests to create their own EmbeddedIamApiForTest instance
- Each test now has isolated state, preventing test interdependencies
* Add comprehensive test coverage for embedded IAM
Added tests for previously uncovered functions:
- iamStringSlicesEqual: 0% → 100%
- iamMapToStatementAction: 40% → 100%
- iamMapToIdentitiesAction: 30% → 70%
- iamHash: 100%
- iamStringWithCharset: 85.7%
- GetPolicyDocument: 75% → 100%
- CreatePolicy: 91.7% → 100%
- DeleteUser: 83.3% → 100%
- GetUser: 83.3% → 100%
- ListAccessKeys: 55.6% → 88.9%
New test cases for helper functions, error handling, and edge cases.
* Document IAM code duplication and reference GitHub issue #7747
Added comments to both IAM implementations noting the code duplication
and referencing the tracking issue for future refactoring:
- weed/s3api/s3api_embedded_iam.go (embedded IAM)
- weed/iamapi/iamapi_management_handlers.go (standalone IAM)
See: https://github.com/seaweedfs/seaweedfs/issues/7747
* Implement granular IAM authorization for self-service operations
Previously, all IAM actions required ACTION_ADMIN permission, which was
overly restrictive. This change implements AWS-like granular permissions:
Self-service operations (allowed without admin for own resources):
- CreateAccessKey (on own user)
- DeleteAccessKey (on own user)
- ListAccessKeys (on own user)
- GetUser (on own user)
- UpdateAccessKey (on own user)
Admin-only operations:
- CreateUser, DeleteUser, UpdateUser
- PutUserPolicy, GetUserPolicy, DeleteUserPolicy
- CreatePolicy
- ListUsers
- Operations on other users
The new AuthIam middleware:
1. Authenticates the request (signature verification)
2. Parses the IAM Action and target UserName
3. For self-service actions, allows if user is operating on own resources
4. For all other actions or operations on other users, requires admin
* Fix misleading comment in standalone IAM CreatePolicy
The comment incorrectly stated that CreatePolicy only validates the policy
document. In the standalone IAM server, CreatePolicy actually persists
the policy via iama.s3ApiConfig.PutPolicies(). The changed flag is false
because it doesn't modify s3cfg.Identities, not because nothing is stored.
* Simplify IAM auth and add RequestId to responses
- Remove redundant ACTION_ADMIN fallback in AuthIam: The action parameter
in authRequest is for permission checking, not signature verification.
If auth fails with ACTION_READ, it will fail with ACTION_ADMIN too.
- Add SetRequestId() call before writing IAM responses for AWS compatibility.
All IAM response structs embed iamCommonResponse which has SetRequestId().
* Address code review feedback for IAM implementation
1. auth_credentials.go: Add documentation warning that LookupByAccessKey
returns internal pointers that should not be mutated.
2. iamapi_management_handlers.go & s3api_embedded_iam.go: Add input guards
for StringWithCharset/iamStringWithCharset when length <= 0 or charset
is empty to avoid runtime errors from rand.Int.
3. s3api_embedded_iam_test.go: Don't ignore xml.Marshal errors in test
DoActions handler. Return proper error response if marshaling fails.
4. s3api_embedded_iam_test.go: Use obviously fake access key IDs
(AKIATESTFAKEKEY*) to avoid CI secret scanner false positives.
* Address code review feedback for IAM implementation (batch 2)
1. iamapi/iamapi_management_handlers.go:
- Redact Authorization header log (security: avoid exposing signature)
- Add nil-guard for iama.iam before LookupByAccessKey call
2. iamapi/iamapi_test.go:
- Replace real-looking access keys with obviously fake ones
(AKIATESTFAKEKEY*) to avoid CI secret scanner false positives
3. s3api/s3api_embedded_iam.go - CreateUser:
- Validate UserName is not empty (return ErrCodeInvalidInputException)
- Check for duplicate users (return ErrCodeEntityAlreadyExistsException)
4. s3api/s3api_embedded_iam.go - CreateAccessKey:
- Return ErrCodeNoSuchEntityException if user doesn't exist
- Removed implicit user creation behavior
5. s3api/s3api_embedded_iam.go - getActions:
- Fix S3 ARN parsing for bucket/path patterns
- Handle mybucket, mybucket/*, mybucket/path/* correctly
- Return error if no valid actions found in policy
6. s3api/s3api_embedded_iam.go - handleImplicitUsername:
- Redact Authorization header log
- Add nil-guard for e.iam
7. s3api/s3api_embedded_iam.go - DoActions:
- Reload in-memory IAM maps after credential mutations
- Call LoadS3ApiConfigurationFromCredentialManager after save
8. s3api/auth_credentials.go - AuthSignatureOnly:
- Add new signature-only authentication method
- Bypasses S3 authorization checks for IAM operations
- Used by AuthIam to properly separate signature verification
from IAM-specific permission checks
* Fix nil pointer dereference and error handling in IAM
1. AuthIam: Add nil check for identity after AuthSignatureOnly
- AuthSignatureOnly can return nil identity with ErrNone for
authTypePostPolicy or authTypeStreamingUnsigned
- Now returns ErrAccessDenied if identity is nil
2. writeIamErrorResponse: Add missing error code cases
- ErrCodeEntityAlreadyExistsException -> HTTP 409 Conflict
- ErrCodeInvalidInputException -> HTTP 400 Bad Request
3. UpdateUser: Use consistent error handling
- Changed from direct ErrInvalidRequest to writeIamErrorResponse
- Now returns correct HTTP status codes based on error type
* Add IAM config reload to standalone IAM server after mutations
Match the behavior of embedded IAM (s3api_embedded_iam.go) by reloading
the in-memory identity maps after persisting configuration changes.
This ensures newly created access keys are visible to LookupByAccessKey
immediately without requiring a server restart.
* Minor improvements to test helpers and log masking
1. iamapi_test.go: Update mustMarshalJSON to use t.Helper() and t.Fatal()
instead of panic() for better test diagnostics
2. s3api_embedded_iam.go: Mask access key in 'not found' log message
to avoid exposing full access key IDs in logs
* Mask access key in standalone IAM log message for consistency
Match the embedded IAM version by masking the access key ID in
the 'not found' log message (show only first 4 chars).
