508d06d9a5
* evaluate policies during authorization * cache bucket policy * refactor * matching with regex special characters * Case Sensitivity, pattern cache, Dead Code Removal * Fixed Typo, Restored []string Case, Added Cache Size Limit * hook up with policy engine * remove old implementation * action mapping * validate * if not specified, fall through to IAM checks * fmt * Fail-close on policy evaluation errors * Explicit `Allow` bypasses IAM checks * fix error message * arn:seaweed => arn:aws * remove legacy support * fix tests * Clean up bucket policy after this test * fix for tests * address comments * security fixes * fix tests * temp comment out
40 lines
1.3 KiB
Go
40 lines
1.3 KiB
Go
package utils
|
|
|
|
import "strings"
|
|
|
|
// ExtractRoleNameFromPrincipal extracts role name from principal ARN
|
|
// Handles both STS assumed role and IAM role formats
|
|
func ExtractRoleNameFromPrincipal(principal string) string {
|
|
// Handle STS assumed role format: arn:aws:sts::assumed-role/RoleName/SessionName
|
|
stsPrefix := "arn:aws:sts::assumed-role/"
|
|
if strings.HasPrefix(principal, stsPrefix) {
|
|
remainder := principal[len(stsPrefix):]
|
|
// Split on first '/' to get role name
|
|
if slashIndex := strings.Index(remainder, "/"); slashIndex != -1 {
|
|
return remainder[:slashIndex]
|
|
}
|
|
// If no slash found, return the remainder (edge case)
|
|
return remainder
|
|
}
|
|
|
|
// Handle IAM role format: arn:aws:iam::role/RoleName
|
|
iamPrefix := "arn:aws:iam::role/"
|
|
if strings.HasPrefix(principal, iamPrefix) {
|
|
return principal[len(iamPrefix):]
|
|
}
|
|
|
|
// Return empty string to signal invalid ARN format
|
|
// This allows callers to handle the error explicitly instead of masking it
|
|
return ""
|
|
}
|
|
|
|
// ExtractRoleNameFromArn extracts role name from an IAM role ARN
|
|
// Specifically handles: arn:aws:iam::role/RoleName
|
|
func ExtractRoleNameFromArn(roleArn string) string {
|
|
prefix := "arn:aws:iam::role/"
|
|
if strings.HasPrefix(roleArn, prefix) && len(roleArn) > len(prefix) {
|
|
return roleArn[len(prefix):]
|
|
}
|
|
return ""
|
|
}
|