gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-24 13:16:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(policy): allow AssumeRole in system policies (#2718)

Browse Source
This commit is contained in:
cxymds
2026-04-28 19:01:46 +08:00
committed by GitHub
parent 2953558f41
commit c698a0f2b6
7 changed files with 63 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/policy/src/policy/policy.rs
+30 -1
View File
@@ -357,7 +357,7 @@ pub mod default {
use crate::policy::{
ActionSet, DEFAULT_VERSION, Effect, Functions, ResourceSet, Statement,
action::{Action, AdminAction, KmsAction, S3Action},
action::{Action, AdminAction, KmsAction, S3Action, StsAction},
resource::Resource,
};
@@ -377,6 +377,7 @@ pub mod default {
actions: ActionSet({
let mut hash_set = HashSet::new();
hash_set.insert(Action::S3Action(S3Action::AllActions));
hash_set.insert(Action::StsAction(StsAction::AssumeRoleAction));
hash_set
}),
not_actions: ActionSet(Default::default()),
@@ -403,6 +404,7 @@ pub mod default {
hash_set.insert(Action::S3Action(S3Action::GetBucketLocationAction));
hash_set.insert(Action::S3Action(S3Action::GetObjectAction));
hash_set.insert(Action::S3Action(S3Action::GetBucketQuotaAction));
hash_set.insert(Action::StsAction(StsAction::AssumeRoleAction));
hash_set
}),
not_actions: ActionSet(Default::default()),
@@ -427,6 +429,7 @@ pub mod default {
actions: ActionSet({
let mut hash_set = HashSet::new();
hash_set.insert(Action::S3Action(S3Action::PutObjectAction));
hash_set.insert(Action::StsAction(StsAction::AssumeRoleAction));
hash_set
}),
not_actions: ActionSet(Default::default()),
@@ -451,6 +454,7 @@ pub mod default {
actions: ActionSet({
let mut hash_set = HashSet::new();
hash_set.insert(Action::S3Action(S3Action::PutObjectAction));
hash_set.insert(Action::StsAction(StsAction::AssumeRoleAction));
hash_set
}),
not_actions: ActionSet(Default::default()),
@@ -482,6 +486,7 @@ pub mod default {
hash_set.insert(Action::AdminAction(AdminAction::HealthInfoAdminAction));
hash_set.insert(Action::AdminAction(AdminAction::PrometheusAdminAction));
hash_set.insert(Action::AdminAction(AdminAction::BandwidthMonitorAction));
hash_set.insert(Action::StsAction(StsAction::AssumeRoleAction));
hash_set
}),
not_actions: ActionSet(Default::default()),
@@ -507,6 +512,7 @@ pub mod default {
actions: ActionSet({
let mut hash_set = HashSet::new();
hash_set.insert(Action::AdminAction(AdminAction::AllAdminActions));
hash_set.insert(Action::StsAction(StsAction::AssumeRoleAction));
hash_set
}),
not_actions: ActionSet(Default::default()),
@@ -520,6 +526,7 @@ pub mod default {
actions: ActionSet({
let mut hash_set = HashSet::new();
hash_set.insert(Action::KmsAction(KmsAction::AllActions));
hash_set.insert(Action::StsAction(StsAction::AssumeRoleAction));
hash_set
}),
not_actions: ActionSet(Default::default()),
@@ -533,6 +540,7 @@ pub mod default {
actions: ActionSet({
let mut hash_set = HashSet::new();
hash_set.insert(Action::S3Action(S3Action::AllActions));
hash_set.insert(Action::StsAction(StsAction::AssumeRoleAction));
hash_set
}),
not_actions: ActionSet(Default::default()),
@@ -684,6 +692,27 @@ mod test {
Ok(())
}
#[tokio::test]
async fn test_default_policies_allow_sts_assume_role() {
let conditions = HashMap::new();
let claims = HashMap::new();
let args = Args {
account: "testuser",
groups: &None,
action: Action::StsAction(crate::policy::action::StsAction::AssumeRoleAction),
bucket: "",
conditions: &conditions,
is_owner: false,
object: "",
claims: &claims,
deny_only: false,
};
for (name, policy) in default::DEFAULT_POLICIES.iter() {
assert!(policy.is_allowed(&args).await, "default policy {name} should allow sts:AssumeRole");
}
}
#[tokio::test]
async fn test_deny_only_checks_only_deny_statements() -> Result<()> {
let data = r#"
crates/scanner/tests/lifecycle_integration_test.rs
+6
View File
@@ -850,6 +850,7 @@ mod serial_tests {
#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
#[serial]
#[ignore = "requires isolated global object layer state"]
async fn test_transition_and_restore_flows() {
let (_disk_paths, ecstore) = setup_test_env().await;
@@ -1218,6 +1219,7 @@ mod serial_tests {
#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
#[serial]
#[ignore = "requires isolated global object layer state"]
async fn test_scanner_expires_zero_day_current_version() {
let (disk_paths, ecstore) = setup_isolated_test_env(false).await;
@@ -1244,6 +1246,7 @@ mod serial_tests {
#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
#[serial]
#[ignore = "requires isolated global object layer state"]
async fn test_put_object_immediately_enqueues_zero_day_current_expiry() {
let (_disk_paths, ecstore) = setup_isolated_test_env(true).await;
@@ -1281,6 +1284,7 @@ mod serial_tests {
#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
#[serial]
#[ignore = "requires isolated global object layer state"]
async fn test_scanner_expires_zero_day_noncurrent_version() {
let (disk_paths, ecstore) = setup_isolated_test_env(false).await;
@@ -1347,6 +1351,7 @@ mod serial_tests {
#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
#[serial]
#[ignore = "requires isolated global object layer state"]
async fn test_put_object_immediately_enqueues_zero_day_noncurrent_expiry() {
let (_disk_paths, ecstore) = setup_isolated_test_env(true).await;
@@ -1431,6 +1436,7 @@ mod serial_tests {
#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
#[serial]
#[ignore = "requires isolated global object layer state"]
async fn test_background_scanner_expires_zero_day_current_version_for_exact_key_prefix() {
let (_disk_paths, ecstore) = setup_isolated_test_env(true).await;