mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-08 14:23:13 +00:00
Zhengchao An
fc3896f479
* feat(policy): add built-in KMS role policies KMSKeyAdministrator, KMSKeyUser and KMSAuditor ship as canned identity policies so operators can express KMS role separation without hand-writing the resource grammar. They grant only kms actions, so they compose with an existing data-plane policy, and none of them confers kms:Configure, kms:ServiceControl, kms:ClearCache, kms:Backup or kms:Restore. * docs(kms): document per-key KMS authorization and the role templates * test(kms): add an end-to-end negative authorization matrix Covers the admin and SSE-KMS planes for a wrong identity, a wrong key, a wrong action and an explicit Deny, each preceded by a positive control so a denial cannot be an unpropagated policy. SSE-S3 and unencrypted objects are asserted to stay exempt. * test(replication): pin the SSE-KMS contract with per-key authorization on The replication worker carries no request identity, so it must stay exempt from SSE-KMS key authorization. Running the existing contract with the switch enabled makes a regression in that exemption visible here.
59 lines
1.3 KiB
Rust
59 lines
1.3 KiB
Rust
// Copyright 2024 RustFS Team
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
//! KMS (Key Management Service) End-to-End Tests
|
|
//!
|
|
//! This module contains comprehensive end-to-end tests for RustFS KMS functionality,
|
|
//! including tests for both Local and Vault backends.
|
|
|
|
// KMS-specific common utilities
|
|
#[cfg(test)]
|
|
pub mod common;
|
|
|
|
#[cfg(test)]
|
|
mod kms_local_test;
|
|
|
|
#[cfg(test)]
|
|
mod kms_vault_test;
|
|
|
|
#[cfg(test)]
|
|
mod kms_comprehensive_test;
|
|
|
|
#[cfg(test)]
|
|
mod multipart_encryption_test;
|
|
|
|
#[cfg(test)]
|
|
mod kms_edge_cases_test;
|
|
|
|
#[cfg(test)]
|
|
mod kms_fault_recovery_test;
|
|
|
|
#[cfg(test)]
|
|
mod test_runner;
|
|
|
|
#[cfg(test)]
|
|
mod bucket_default_encryption_test;
|
|
|
|
#[cfg(test)]
|
|
mod encryption_metadata_test;
|
|
|
|
#[cfg(test)]
|
|
mod copy_object_version_restore_sse_test;
|
|
|
|
#[cfg(test)]
|
|
mod configured_roundtrip_test;
|
|
|
|
#[cfg(test)]
|
|
mod kms_authorization_negative_matrix_test;
|