gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-05 21:07:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(kms): add an end-to-end negative authorization matrix

Browse Source 
Covers the admin and SSE-KMS planes for a wrong identity, a wrong key, a
wrong action and an explicit Deny, each preceded by a positive control so a
denial cannot be an unpropagated policy. SSE-S3 and unencrypted objects are
asserted to stay exempt.
This commit is contained in:
overtrue
2026-08-02 02:46:47 +08:00
parent 0c409e306f
commit 1a598ae7c0
3 changed files with 487 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/operations/kms-per-key-authorization.md
+1 -1
View File
@@ -21,7 +21,7 @@ Rules worth knowing before writing a policy:
- A statement carrying a KMS resource with non-KMS actions is rejected.
- A KMS statement with **no** resource matches every key. This is the legacy form and stays valid, so existing policies keep their current effect.
- A KMS statement whose resources are S3 ARNs predates KMS resources. It is still loadable, but the S3 patterns never constrained key access, so evaluation ignores them, treats the statement as unscoped, and logs a warning. Rewrite these with real KMS resources.
- Bucket policies reject `kms:` statements outright. KMS grants belong to identities.
- `PutBucketPolicy` rejects any statement carrying a `kms:` action or a KMS resource. KMS grants belong to identities. Bucket policies stored before this check still load; evaluation skips their pure-KMS statements and warns.
- `Deny` wins, as everywhere else: a `Deny` on `arn:aws:kms:::key/payroll-*` overrides an `Allow` on `arn:aws:kms:::*`.
- The key identifier matched is the one the request names, before any alias resolution.