From 9c269248de8ca7133c3da844581035f3d94587e2 Mon Sep 17 00:00:00 2001
From: overtrue <anzhengchao@gmail.com>
Date: Sat, 1 Aug 2026 13:41:22 +0800
Subject: [PATCH] feat(s3-types): add KMS service-control audit events

Configuration changes and service start/stop are management-plane actions
with no event name of their own, so they could not reach the audit
pipeline at all. Append three variants for them, following the existing
rule that KMS events are audit-only and live outside the `s3:` namespace,
so no bucket notification selector can expand to them.
---
 crates/notify/src/rules/rules_map_test.rs |  3 +++
 crates/s3-types/src/event_name.rs         | 30 +++++++++++++++++++----
 2 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/crates/notify/src/rules/rules_map_test.rs b/crates/notify/src/rules/rules_map_test.rs
index 93ff68cf3..16084e3df 100644
--- a/crates/notify/src/rules/rules_map_test.rs
+++ b/crates/notify/src/rules/rules_map_test.rs
@@ -32,6 +32,9 @@ const KMS_EVENTS: &[EventName] = &[
     EventName::KmsKeyDeletionCancelled,
     EventName::KmsKeyDeleted,
     EventName::KmsKeyAccessed,
+    EventName::KmsServiceConfigured,
+    EventName::KmsServiceStarted,
+    EventName::KmsServiceStopped,
 ];
 
 fn test_target() -> TargetID {
diff --git a/crates/s3-types/src/event_name.rs b/crates/s3-types/src/event_name.rs
index 663201905..a028cb39a 100644
--- a/crates/s3-types/src/event_name.rs
+++ b/crates/s3-types/src/event_name.rs
@@ -87,11 +87,13 @@ pub enum EventName {
     ObjectCreatedCreateMultipartUpload,
     ObjectRemovedDeleteObjects,
 
-    // KMS management-plane events. They travel to the audit sink only and are
-    // never produced by the bucket notification path, so no compound `s3:`
-    // event expands to them. New variants must keep being appended here: the
-    // discriminant of every preceding variant is a `mask()` bit position, and
-    // inserting in the middle would silently renumber existing bits.
+    // KMS management-plane events, covering both key operations and the
+    // service-control endpoints that change which backend holds the keys. They
+    // travel to the audit sink only and are never produced by the bucket
+    // notification path, so no compound `s3:` event expands to them. New
+    // variants must keep being appended here: the discriminant of every
+    // preceding variant is a `mask()` bit position, and inserting in the middle
+    // would silently renumber existing bits.
     KmsKeyCreated,
     KmsKeyRotated,
     KmsKeyEnabled,
@@ -100,6 +102,9 @@ pub enum EventName {
     KmsKeyDeletionCancelled,
     KmsKeyDeleted,
     KmsKeyAccessed,
+    KmsServiceConfigured,
+    KmsServiceStarted,
+    KmsServiceStopped,
 }
 
 // Single event type sequential array for Everything.expand()
@@ -211,6 +216,9 @@ impl EventName {
             "kms:Key:DeletionCancelled" => Ok(EventName::KmsKeyDeletionCancelled),
             "kms:Key:Deleted" => Ok(EventName::KmsKeyDeleted),
             "kms:Key:Accessed" => Ok(EventName::KmsKeyAccessed),
+            "kms:Service:Configured" => Ok(EventName::KmsServiceConfigured),
+            "kms:Service:Started" => Ok(EventName::KmsServiceStarted),
+            "kms:Service:Stopped" => Ok(EventName::KmsServiceStopped),
             // `Everything` has no string representation (`as_str` yields ""), so it
             // cannot be parsed back from a string. Every other variant round-trips.
             _ => Err(ParseEventNameError(s.to_string())),
@@ -284,6 +292,9 @@ impl EventName {
             EventName::KmsKeyDeletionCancelled => "kms:Key:DeletionCancelled",
             EventName::KmsKeyDeleted => "kms:Key:Deleted",
             EventName::KmsKeyAccessed => "kms:Key:Accessed",
+            EventName::KmsServiceConfigured => "kms:Service:Configured",
+            EventName::KmsServiceStarted => "kms:Service:Started",
+            EventName::KmsServiceStopped => "kms:Service:Stopped",
         }
     }
 
@@ -407,6 +418,9 @@ impl EventName {
                 | EventName::KmsKeyDeletionCancelled
                 | EventName::KmsKeyDeleted
                 | EventName::KmsKeyAccessed
+                | EventName::KmsServiceConfigured
+                | EventName::KmsServiceStarted
+                | EventName::KmsServiceStopped
         )
     }
 }
@@ -630,6 +644,9 @@ mod tests {
         EventName::KmsKeyDeletionCancelled,
         EventName::KmsKeyDeleted,
         EventName::KmsKeyAccessed,
+        EventName::KmsServiceConfigured,
+        EventName::KmsServiceStarted,
+        EventName::KmsServiceStopped,
     ];
 
     /// Every KMS management-plane event.
@@ -642,6 +659,9 @@ mod tests {
         EventName::KmsKeyDeletionCancelled,
         EventName::KmsKeyDeleted,
         EventName::KmsKeyAccessed,
+        EventName::KmsServiceConfigured,
+        EventName::KmsServiceStarted,
+        EventName::KmsServiceStopped,
     ];
 
     /// Regression for backlog#965: `mask()` used to recurse forever for the