mirror of https://github.com/rustfs/rustfs.git synced 2026-07-26 08:18:18 +00:00

Files

T

Zhengchao An 776f7ee83f test(security): add bucket-policy x IAM priority conflict matrix (#4825 )

The individual policy layers were tested in isolation, but the cross-layer
resolution — which layer wins when IAM and bucket policy disagree — had no
coverage. A priority error there is a data-exposure or data-lockout bug.

Add crates/policy/tests/bucket_iam_authz_matrix.rs, a pure table-driven test
(no globals, no IAM store, no server) that drives the real Policy::is_allowed
and BucketPolicy::is_allowed through a helper modeling the request-layer
orchestration in rustfs::storage::access::authorize_request (bucket explicit-Deny
gate -> IAM allow -> bucket allow fallback; anonymous = bucket policy alone). It
pins all four Allow/Deny quadrants plus the anonymous case, and adds intra-policy
Deny-beats-Allow checks for both layers.

The matrix surfaces the resolution invariant explicitly: a BUCKET explicit Deny
is a hard gate and always wins, but an IAM explicit Deny is SOFT — a bucket Allow
fallback overrides it, which diverges from AWS "an explicit Deny in any policy
always wins". The test characterizes the current (MinIO-lineage) behavior; if IAM
Deny is later hardened into a gate, iam_deny_x_bucket_allow flips to false and
must be updated deliberately.

Refs: backlog#1151 (sec-8)

Co-authored-by: houseme <housemecn@gmail.com>

2026-07-15 04:06:26 +00:00

src

fix(policy): compare NotResource in Statement equality (#4454 )

2026-07-08 17:02:20 +08:00

tests

test(security): add bucket-policy x IAM priority conflict matrix (#4825 )

2026-07-15 04:06:26 +00:00

AGENTS.md

docs: scope AGENTS instructions by directory (#2083 )

2026-03-05 17:25:37 +08:00

Cargo.toml

feat(metrics): migrate system monitoring from rustfs-obs to rustfs-metrics (#2242 )

2026-03-20 18:52:33 +08:00

README.md

docs: fix some dead link (#1053 )

2025-12-08 11:23:24 +08:00

README.md

RustFS Policy - Policy Engine

Advanced policy engine and access control system for RustFS distributed object storage

📖 Documentation · 🐛 Bug Reports · 💬 Discussions

📖 Overview

RustFS Policy provides advanced policy engine and access control capabilities for the RustFS distributed object storage system. For the complete RustFS experience, please visit the main RustFS repository.

✨ Features

AWS-compatible bucket policy engine
Fine-grained resource-based access control
Condition-based policy evaluation
Policy validation and syntax checking
Role-based access control integration
Dynamic policy evaluation with context

📚 Documentation

For comprehensive documentation, examples, and usage guides, please visit the main RustFS repository.

📄 License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.