Chris Lu 6fb3ec968d s3: allow -s3.config and -s3.iam.config to work together (#7727) ...

When both -s3.config and -s3.iam.config are configured, traditional
credentials from -s3.config were failing with Access Denied because
the authorization code always used IAM authorization when IAM
integration was configured.

The fix checks if the identity has legacy Actions (from -s3.config).
If so, use the legacy canDo() authorization. Only use IAM authorization
for JWT/STS identities that don't have legacy Actions.

This allows both configuration options to coexist:
- Traditional credentials use legacy authorization
- JWT/STS credentials use IAM authorization

Fixes #7720

2025-12-12 14:45:23 -08:00

28 KiB

Raw Blame History

View Raw