mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-12 16:16:55 +00:00
test(kms): add an end-to-end negative authorization matrix
Covers the admin and SSE-KMS planes for a wrong identity, a wrong key, a wrong action and an explicit Deny, each preceded by a positive control so a denial cannot be an unpropagated policy. SSE-S3 and unencrypted objects are asserted to stay exempt.
This commit is contained in:
overtrue
@@ -0,0 +1,483 @@
|
||||
// Copyright 2024 RustFS Team
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
//! Negative authorization matrix for per-key KMS access control.
|
||||
//!
|
||||
//! Every case here is an end-to-end denial that the pre-`kms` resource server
|
||||
//! allowed, so a regression that reopens one of them fails this file rather than
|
||||
//! only a unit test. The matrix varies one dimension at a time:
|
||||
//!
|
||||
//! - **wrong identity**: a caller holding S3 rights but no `kms` grant at all
|
||||
//! - **wrong key**: a caller scoped to key A naming key B
|
||||
//! - **wrong action**: a caller holding `kms:GenerateDataKey` but not `kms:Decrypt`
|
||||
//! (and, on the admin plane, `kms:DisableKey` but not `kms:RotateKey`)
|
||||
//! - **wrong context**: an explicit `Deny` beating a wildcard `Allow`, and SSE-S3
|
||||
//! staying exempt from `kms` authorization
|
||||
//!
|
||||
//! Each matrix opens with a positive control. Without it a denial proves nothing:
|
||||
//! an identity whose policy has not propagated yet is denied everything.
|
||||
|
||||
use super::common::{LocalKMSTestEnvironment, create_key_with_specific_id};
|
||||
use crate::common::{admin_ok, admin_request, init_logging};
|
||||
use aws_sdk_s3::Client;
|
||||
use aws_sdk_s3::config::{Config, Credentials, Region};
|
||||
use aws_sdk_s3::error::ProvideErrorMetadata;
|
||||
use aws_sdk_s3::primitives::ByteStream;
|
||||
use aws_sdk_s3::types::ServerSideEncryption;
|
||||
use serial_test::serial;
|
||||
use std::time::Duration;
|
||||
use tracing::info;
|
||||
|
||||
type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
|
||||
|
||||
const ALLOWED_KEY: &str = "kms-matrix-allowed-key";
|
||||
const OTHER_KEY: &str = "kms-matrix-other-key";
|
||||
const BUCKET: &str = "kms-authz-matrix";
|
||||
const SECRET: &str = "kms-matrix-secret";
|
||||
const PAYLOAD: &[u8] = b"kms authorization matrix payload";
|
||||
|
||||
/// How long an identity change may take to reach the request path.
|
||||
const IAM_PROPAGATION: Duration = Duration::from_secs(20);
|
||||
|
||||
fn s3_client(url: &str, access_key: &str, secret_key: &str) -> Client {
|
||||
let config = Config::builder()
|
||||
.credentials_provider(Credentials::new(access_key, secret_key, None, None, "kms-authz-matrix"))
|
||||
.region(Region::new("us-east-1"))
|
||||
.endpoint_url(url)
|
||||
.force_path_style(true)
|
||||
.behavior_version_latest()
|
||||
.build();
|
||||
Client::from_conf(config)
|
||||
}
|
||||
|
||||
/// Start a server whose SSE-KMS data path authorizes against the named key.
|
||||
///
|
||||
/// The enforcement switch defaults to off for compatibility, so it has to be set
|
||||
/// explicitly; without it every negative case below would silently pass as an allow.
|
||||
async fn start_enforcing_server(env: &mut LocalKMSTestEnvironment, extra_env: &[(&str, &str)]) -> TestResult {
|
||||
create_key_with_specific_id(&env.kms_keys_dir, ALLOWED_KEY).await?;
|
||||
create_key_with_specific_id(&env.kms_keys_dir, OTHER_KEY).await?;
|
||||
|
||||
let key_dir = env.kms_keys_dir.clone();
|
||||
let args = vec![
|
||||
"--kms-enable",
|
||||
"--kms-backend",
|
||||
"local",
|
||||
"--kms-key-dir",
|
||||
key_dir.as_str(),
|
||||
"--kms-default-key-id",
|
||||
ALLOWED_KEY,
|
||||
];
|
||||
|
||||
let mut envs = vec![("RUSTFS_KMS_ALLOW_INSECURE_DEV_DEFAULTS", "true")];
|
||||
envs.extend_from_slice(extra_env);
|
||||
|
||||
env.base_env.start_rustfs_server_with_env(args, &envs).await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Create `user` with `policy_document` attached under a canned policy of the same name.
|
||||
async fn provision_user(env: &LocalKMSTestEnvironment, user: &str, policy_document: &str) -> TestResult {
|
||||
admin_ok(
|
||||
&env.base_env,
|
||||
http::Method::PUT,
|
||||
&format!("/rustfs/admin/v3/add-canned-policy?name={user}"),
|
||||
Some(policy_document.to_string()),
|
||||
)
|
||||
.await?;
|
||||
provision_user_with_policy(env, user, user).await
|
||||
}
|
||||
|
||||
/// Create `user` and attach an existing policy (built-in or canned) by name.
|
||||
async fn provision_user_with_policy(env: &LocalKMSTestEnvironment, user: &str, policy_name: &str) -> TestResult {
|
||||
admin_ok(
|
||||
&env.base_env,
|
||||
http::Method::PUT,
|
||||
&format!("/rustfs/admin/v3/add-user?accessKey={user}"),
|
||||
Some(serde_json::json!({ "secretKey": SECRET, "status": "enabled" }).to_string()),
|
||||
)
|
||||
.await?;
|
||||
admin_ok(
|
||||
&env.base_env,
|
||||
http::Method::PUT,
|
||||
&format!("/rustfs/admin/v3/set-user-or-group-policy?policyName={policy_name}&userOrGroup={user}&isGroup=false"),
|
||||
None,
|
||||
)
|
||||
.await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// The S3 half of every data-path policy below: full object access, no KMS grant.
|
||||
fn s3_full_access_statement() -> serde_json::Value {
|
||||
serde_json::json!({
|
||||
"Effect": "Allow",
|
||||
"Action": ["s3:*"],
|
||||
"Resource": ["arn:aws:s3:::*"]
|
||||
})
|
||||
}
|
||||
|
||||
fn policy_document(statements: Vec<serde_json::Value>) -> String {
|
||||
serde_json::json!({ "Version": "2012-10-17", "Statement": statements }).to_string()
|
||||
}
|
||||
|
||||
async fn put_sse_kms(client: &Client, key: &str, kms_key_id: &str) -> Result<(), aws_sdk_s3::Error> {
|
||||
client
|
||||
.put_object()
|
||||
.bucket(BUCKET)
|
||||
.key(key)
|
||||
.body(ByteStream::from_static(PAYLOAD))
|
||||
.server_side_encryption(ServerSideEncryption::AwsKms)
|
||||
.ssekms_key_id(kms_key_id)
|
||||
.send()
|
||||
.await
|
||||
.map(|_| ())
|
||||
.map_err(aws_sdk_s3::Error::from)
|
||||
}
|
||||
|
||||
/// Assert the operation failed with `AccessDenied` rather than any other error.
|
||||
///
|
||||
/// A bare `is_err` would also accept `KMSKeyDisabled` or an internal error, which
|
||||
/// would hide both a leak of key state and an outage masquerading as a denial.
|
||||
fn assert_access_denied<T: std::fmt::Debug>(result: Result<T, aws_sdk_s3::Error>, what: &str) {
|
||||
let error = result.expect_err(&format!("{what} must be denied"));
|
||||
assert_eq!(error.code(), Some("AccessDenied"), "{what} must fail with AccessDenied: {error:?}");
|
||||
}
|
||||
|
||||
/// Retry an SSE-KMS write until the identity's policy has reached the request path.
|
||||
async fn wait_for_sse_kms_write(client: &Client, key: &str, kms_key_id: &str) -> TestResult {
|
||||
let deadline = tokio::time::Instant::now() + IAM_PROPAGATION;
|
||||
loop {
|
||||
match put_sse_kms(client, key, kms_key_id).await {
|
||||
Ok(()) => return Ok(()),
|
||||
Err(error) if tokio::time::Instant::now() >= deadline => {
|
||||
return Err(format!("positive control never became authorized: {error:?}").into());
|
||||
}
|
||||
Err(_) => tokio::time::sleep(Duration::from_millis(500)).await,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Retry an admin call until it stops returning 403, i.e. the policy is live.
|
||||
async fn wait_for_admin_success(
|
||||
env: &LocalKMSTestEnvironment,
|
||||
user: &str,
|
||||
method: http::Method,
|
||||
path: &str,
|
||||
body: Option<String>,
|
||||
) -> TestResult {
|
||||
let deadline = tokio::time::Instant::now() + IAM_PROPAGATION;
|
||||
loop {
|
||||
let (status, response) = admin_request(&env.base_env.url, method.clone(), path, body.clone(), user, SECRET).await?;
|
||||
if status.is_success() {
|
||||
return Ok(());
|
||||
}
|
||||
if tokio::time::Instant::now() >= deadline {
|
||||
return Err(format!("positive control never became authorized: {method} {path} -> {status} {response}").into());
|
||||
}
|
||||
tokio::time::sleep(Duration::from_millis(500)).await;
|
||||
}
|
||||
}
|
||||
|
||||
async fn assert_admin_denied(
|
||||
env: &LocalKMSTestEnvironment,
|
||||
user: &str,
|
||||
method: http::Method,
|
||||
path: &str,
|
||||
body: Option<String>,
|
||||
what: &str,
|
||||
) -> TestResult {
|
||||
let (status, response) = admin_request(&env.base_env.url, method, path, body, user, SECRET).await?;
|
||||
assert_eq!(status.as_u16(), 403, "{what} must be denied, got {status}: {response}");
|
||||
assert!(response.contains("AccessDenied"), "{what} must carry AccessDenied: {response}");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn disable_body(key_id: &str) -> String {
|
||||
serde_json::json!({ "key_id": key_id }).to_string()
|
||||
}
|
||||
|
||||
/// Data-path matrix: SSE-KMS writes and reads are authorized against the resolved key.
|
||||
#[tokio::test]
|
||||
#[serial]
|
||||
async fn sse_kms_per_key_authorization_negative_matrix() -> TestResult {
|
||||
init_logging();
|
||||
|
||||
let mut env = LocalKMSTestEnvironment::new().await?;
|
||||
start_enforcing_server(&mut env, &[("RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY", "true")]).await?;
|
||||
env.base_env.create_test_bucket(BUCKET).await?;
|
||||
|
||||
// Scoped to ALLOWED_KEY only.
|
||||
provision_user(
|
||||
&env,
|
||||
"kmsmatrixscoped",
|
||||
&policy_document(vec![
|
||||
s3_full_access_statement(),
|
||||
serde_json::json!({
|
||||
"Effect": "Allow",
|
||||
"Action": ["kms:GenerateDataKey", "kms:Decrypt"],
|
||||
"Resource": [format!("arn:aws:kms:::key/{ALLOWED_KEY}")]
|
||||
}),
|
||||
]),
|
||||
)
|
||||
.await?;
|
||||
// S3 rights only: the identity shape that existed before per-key authorization.
|
||||
provision_user(&env, "kmsmatrixs3only", &policy_document(vec![s3_full_access_statement()])).await?;
|
||||
// May wrap a data key but may never unwrap one.
|
||||
provision_user(
|
||||
&env,
|
||||
"kmsmatrixwriter",
|
||||
&policy_document(vec![
|
||||
s3_full_access_statement(),
|
||||
serde_json::json!({
|
||||
"Effect": "Allow",
|
||||
"Action": ["kms:GenerateDataKey"],
|
||||
"Resource": ["arn:aws:kms:::*"]
|
||||
}),
|
||||
]),
|
||||
)
|
||||
.await?;
|
||||
// Wildcard allow, explicit deny on one key.
|
||||
provision_user(
|
||||
&env,
|
||||
"kmsmatrixdenied",
|
||||
&policy_document(vec![
|
||||
s3_full_access_statement(),
|
||||
serde_json::json!({
|
||||
"Effect": "Allow",
|
||||
"Action": ["kms:*"],
|
||||
"Resource": ["arn:aws:kms:::*"]
|
||||
}),
|
||||
serde_json::json!({
|
||||
"Effect": "Deny",
|
||||
"Action": ["kms:*"],
|
||||
"Resource": [format!("arn:aws:kms:::key/{OTHER_KEY}")]
|
||||
}),
|
||||
]),
|
||||
)
|
||||
.await?;
|
||||
|
||||
let scoped = s3_client(&env.base_env.url, "kmsmatrixscoped", SECRET);
|
||||
let s3_only = s3_client(&env.base_env.url, "kmsmatrixs3only", SECRET);
|
||||
let writer = s3_client(&env.base_env.url, "kmsmatrixwriter", SECRET);
|
||||
let denied = s3_client(&env.base_env.url, "kmsmatrixdenied", SECRET);
|
||||
|
||||
// --- positive control -----------------------------------------------------
|
||||
wait_for_sse_kms_write(&scoped, "scoped/allowed", ALLOWED_KEY).await?;
|
||||
let read = scoped.get_object().bucket(BUCKET).key("scoped/allowed").send().await?;
|
||||
assert_eq!(read.body.collect().await?.into_bytes().as_ref(), PAYLOAD);
|
||||
info!("positive control: scoped identity may write and read under its own key");
|
||||
|
||||
// --- wrong key ------------------------------------------------------------
|
||||
assert_access_denied(
|
||||
put_sse_kms(&scoped, "scoped/other", OTHER_KEY).await,
|
||||
"SSE-KMS write under a key outside the identity's scope",
|
||||
);
|
||||
|
||||
// --- wrong identity -------------------------------------------------------
|
||||
assert_access_denied(
|
||||
put_sse_kms(&s3_only, "s3only/allowed", ALLOWED_KEY).await,
|
||||
"SSE-KMS write by an identity holding no kms grant",
|
||||
);
|
||||
// The object the scoped identity wrote is readable by its owner only.
|
||||
assert_access_denied(
|
||||
s3_only
|
||||
.get_object()
|
||||
.bucket(BUCKET)
|
||||
.key("scoped/allowed")
|
||||
.send()
|
||||
.await
|
||||
.map(|_| ())
|
||||
.map_err(aws_sdk_s3::Error::from),
|
||||
"SSE-KMS read by an identity holding no kms grant",
|
||||
);
|
||||
|
||||
// --- wrong action ---------------------------------------------------------
|
||||
wait_for_sse_kms_write(&writer, "writer/allowed", ALLOWED_KEY).await?;
|
||||
assert_access_denied(
|
||||
writer
|
||||
.get_object()
|
||||
.bucket(BUCKET)
|
||||
.key("writer/allowed")
|
||||
.send()
|
||||
.await
|
||||
.map(|_| ())
|
||||
.map_err(aws_sdk_s3::Error::from),
|
||||
"SSE-KMS read by an identity holding kms:GenerateDataKey but not kms:Decrypt",
|
||||
);
|
||||
|
||||
// --- wrong context: explicit Deny beats a wildcard Allow -------------------
|
||||
wait_for_sse_kms_write(&denied, "denied/allowed", ALLOWED_KEY).await?;
|
||||
assert_access_denied(
|
||||
put_sse_kms(&denied, "denied/other", OTHER_KEY).await,
|
||||
"SSE-KMS write under a key covered by an explicit Deny",
|
||||
);
|
||||
|
||||
// --- wrong context: SSE-S3 is out of scope --------------------------------
|
||||
// SSE-S3 wraps its data key with a server-owned key the caller never names, so
|
||||
// it must stay reachable for an identity with no kms grant at all.
|
||||
s3_only
|
||||
.put_object()
|
||||
.bucket(BUCKET)
|
||||
.key("s3only/sse-s3")
|
||||
.body(ByteStream::from_static(PAYLOAD))
|
||||
.server_side_encryption(ServerSideEncryption::Aes256)
|
||||
.send()
|
||||
.await?;
|
||||
let sse_s3_read = s3_only.get_object().bucket(BUCKET).key("s3only/sse-s3").send().await?;
|
||||
assert_eq!(sse_s3_read.body.collect().await?.into_bytes().as_ref(), PAYLOAD);
|
||||
|
||||
// ... and so must an unencrypted object.
|
||||
s3_only
|
||||
.put_object()
|
||||
.bucket(BUCKET)
|
||||
.key("s3only/plain")
|
||||
.body(ByteStream::from_static(PAYLOAD))
|
||||
.send()
|
||||
.await?;
|
||||
s3_only.get_object().bucket(BUCKET).key("s3only/plain").send().await?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Admin-plane matrix: KMS key endpoints are authorized against the key they name.
|
||||
///
|
||||
/// Runs without the SSE enforcement switch: admin scoping is unconditional, and
|
||||
/// leaving the switch off proves the two planes are independent.
|
||||
#[tokio::test]
|
||||
#[serial]
|
||||
async fn kms_admin_per_key_authorization_negative_matrix() -> TestResult {
|
||||
init_logging();
|
||||
|
||||
let mut env = LocalKMSTestEnvironment::new().await?;
|
||||
start_enforcing_server(&mut env, &[]).await?;
|
||||
|
||||
// Built-in role templates, attached by name.
|
||||
provision_user_with_policy(&env, "kmsmatrixkeyadmin", "KMSKeyAdministrator").await?;
|
||||
provision_user_with_policy(&env, "kmsmatrixauditor", "KMSAuditor").await?;
|
||||
// A narrowed copy of the administrator template, scoped to one key.
|
||||
provision_user(
|
||||
&env,
|
||||
"kmsmatrixscopedadmin",
|
||||
&policy_document(vec![serde_json::json!({
|
||||
"Effect": "Allow",
|
||||
"Action": ["kms:DisableKey", "kms:EnableKey"],
|
||||
"Resource": [format!("arn:aws:kms:::key/{ALLOWED_KEY}")]
|
||||
})]),
|
||||
)
|
||||
.await?;
|
||||
|
||||
// --- positive control -----------------------------------------------------
|
||||
wait_for_admin_success(
|
||||
&env,
|
||||
"kmsmatrixkeyadmin",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/disable",
|
||||
Some(disable_body(OTHER_KEY)),
|
||||
)
|
||||
.await?;
|
||||
admin_request(
|
||||
&env.base_env.url,
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/enable",
|
||||
Some(disable_body(OTHER_KEY)),
|
||||
"kmsmatrixkeyadmin",
|
||||
SECRET,
|
||||
)
|
||||
.await?;
|
||||
|
||||
// --- wrong action: the administrator template withholds service-wide powers -
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixkeyadmin",
|
||||
http::Method::GET,
|
||||
"/rustfs/admin/v3/kms/config",
|
||||
None,
|
||||
"KMSKeyAdministrator reading the KMS backend configuration (kms:Configure)",
|
||||
)
|
||||
.await?;
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixkeyadmin",
|
||||
http::Method::GET,
|
||||
"/rustfs/admin/v3/kms/backup",
|
||||
None,
|
||||
"KMSKeyAdministrator exporting a backup bundle (kms:Backup)",
|
||||
)
|
||||
.await?;
|
||||
// Separation of duties: managing a key never implies using it.
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixkeyadmin",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/generate-data-key",
|
||||
Some(serde_json::json!({ "key_id": ALLOWED_KEY }).to_string()),
|
||||
"KMSKeyAdministrator generating a data key (kms:GenerateDataKey)",
|
||||
)
|
||||
.await?;
|
||||
|
||||
// --- wrong action: the auditor template is read-only ----------------------
|
||||
wait_for_admin_success(&env, "kmsmatrixauditor", http::Method::GET, "/rustfs/admin/v3/kms/keys", None).await?;
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixauditor",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/disable",
|
||||
Some(disable_body(ALLOWED_KEY)),
|
||||
"KMSAuditor disabling a key (kms:DisableKey)",
|
||||
)
|
||||
.await?;
|
||||
|
||||
// --- wrong key ------------------------------------------------------------
|
||||
wait_for_admin_success(
|
||||
&env,
|
||||
"kmsmatrixscopedadmin",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/disable",
|
||||
Some(disable_body(ALLOWED_KEY)),
|
||||
)
|
||||
.await?;
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixscopedadmin",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/disable",
|
||||
Some(disable_body(OTHER_KEY)),
|
||||
"key-scoped administrator disabling a key outside its scope",
|
||||
)
|
||||
.await?;
|
||||
// --- wrong action, same key ----------------------------------------------
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixscopedadmin",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/rotate",
|
||||
Some(disable_body(ALLOWED_KEY)),
|
||||
"key-scoped administrator rotating a key it may only enable and disable",
|
||||
)
|
||||
.await?;
|
||||
|
||||
// --- wrong identity -------------------------------------------------------
|
||||
provision_user(&env, "kmsmatrixnokms", &policy_document(vec![s3_full_access_statement()])).await?;
|
||||
assert_admin_denied(
|
||||
&env,
|
||||
"kmsmatrixnokms",
|
||||
http::Method::POST,
|
||||
"/rustfs/admin/v3/kms/keys/disable",
|
||||
Some(disable_body(ALLOWED_KEY)),
|
||||
"identity holding no kms grant disabling a key",
|
||||
)
|
||||
.await?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
@@ -53,3 +53,6 @@ mod copy_object_version_restore_sse_test;
|
||||
|
||||
#[cfg(test)]
|
||||
mod configured_roundtrip_test;
|
||||
|
||||
#[cfg(test)]
|
||||
mod kms_authorization_negative_matrix_test;
|
||||
|
||||
Reference in New Issue
Block a user