Zhengchao An b6d4689c75 feat(policy): parse and match KMS key resources with a kms:Decrypt action (#5515) ...

Bring the dormant Resource::Kms variant to life: arn:aws:kms:::key/<key_id>
patterns (empty-account form, wildcards allowed in the id, alias/<name>
reserved as parse-only) now parse, validate, serialize back, and are matched
by KMS statements against the requested key id carried in Args::object.
Statements without KMS resources keep the legacy match-every-key behaviour,
as do call sites that pass no key resource, so nothing changes until the
admin/SSE authorization paths start passing key ids.

Statement validation rejects KMS resources on non-KMS statements, and bucket
policy validation rejects KMS actions and resources outright while stored
policies keep deserializing; evaluation skips pure-KMS bucket policy
statements with a warning. A kms:Decrypt action is added for the upcoming
SSE-KMS read path.

Refs rustfs/backlog#1582 (part of rustfs/backlog#1562)

2026-08-01 10:05:40 +08:00

..

bucket_iam_authz_matrix.rs

test(security): add bucket-policy x IAM priority conflict matrix (#4825)

2026-07-15 04:06:26 +00:00

policy_eval_proptest.rs

feat(policy): parse and match KMS key resources with a kms:Decrypt action (#5515)

2026-08-01 10:05:40 +08:00

policy_is_allowed.rs

fix(policy): compare NotResource in Statement equality (#4454)

2026-07-08 17:02:20 +08:00

quantified_negation.rs

Merge commit from fork

2026-07-26 07:10:50 +08:00