mirror of https://github.com/rustfs/rustfs.git synced 2026-08-01 19:12:14 +00:00

Files

T

Zhengchao An b6d4689c75 feat(policy): parse and match KMS key resources with a kms:Decrypt action (#5515 )

Bring the dormant Resource::Kms variant to life: arn:aws:kms:::key/<key_id>
patterns (empty-account form, wildcards allowed in the id, alias/<name>
reserved as parse-only) now parse, validate, serialize back, and are matched
by KMS statements against the requested key id carried in Args::object.
Statements without KMS resources keep the legacy match-every-key behaviour,
as do call sites that pass no key resource, so nothing changes until the
admin/SSE authorization paths start passing key ids.

Statement validation rejects KMS resources on non-KMS statements, and bucket
policy validation rejects KMS actions and resources outright while stored
policies keep deserializing; evaluation skips pure-KMS bucket policy
statements with a warning. A kms:Decrypt action is added for the upcoming
SSE-KMS read path.

Refs rustfs/backlog#1582 (part of rustfs/backlog#1562)

2026-08-01 10:05:40 +08:00

src

feat(policy): parse and match KMS key resources with a kms:Decrypt action (#5515 )

2026-08-01 10:05:40 +08:00

tests

feat(policy): parse and match KMS key resources with a kms:Decrypt action (#5515 )

2026-08-01 10:05:40 +08:00

AGENTS.md

docs: scope AGENTS instructions by directory (#2083 )

2026-03-05 17:25:37 +08:00

Cargo.toml

feat: extend hotpath coverage across crates (#5505 )

2026-07-31 05:42:19 +00:00

README.md

docs: fix some dead link (#1053 )

2025-12-08 11:23:24 +08:00

README.md

RustFS Policy - Policy Engine

Advanced policy engine and access control system for RustFS distributed object storage

📖 Documentation · 🐛 Bug Reports · 💬 Discussions

📖 Overview

RustFS Policy provides advanced policy engine and access control capabilities for the RustFS distributed object storage system. For the complete RustFS experience, please visit the main RustFS repository.

✨ Features

AWS-compatible bucket policy engine
Fine-grained resource-based access control
Condition-based policy evaluation
Policy validation and syntax checking
Role-based access control integration
Dynamic policy evaluation with context

📚 Documentation

For comprehensive documentation, examples, and usage guides, please visit the main RustFS repository.

📄 License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.