mirror of https://github.com/rustfs/rustfs.git synced 2026-08-02 11:29:17 +00:00

Files

T

Zhengchao An fc3896f479 feat(policy): add built-in KMS role policies and a negative authorization matrix (#5588 )

* feat(policy): add built-in KMS role policies

KMSKeyAdministrator, KMSKeyUser and KMSAuditor ship as canned identity
policies so operators can express KMS role separation without hand-writing
the resource grammar. They grant only kms actions, so they compose with an
existing data-plane policy, and none of them confers kms:Configure,
kms:ServiceControl, kms:ClearCache, kms:Backup or kms:Restore.

* docs(kms): document per-key KMS authorization and the role templates

* test(kms): add an end-to-end negative authorization matrix

Covers the admin and SSE-KMS planes for a wrong identity, a wrong key, a
wrong action and an explicit Deny, each preceded by a positive control so a
denial cannot be an unpropagated policy. SSE-S3 and unencrypted objects are
asserted to stay exempt.

* test(replication): pin the SSE-KMS contract with per-key authorization on

The replication worker carries no request identity, so it must stay exempt
from SSE-KMS key authorization. Running the existing contract with the
switch enabled makes a regression in that exemption visible here.

2026-08-01 19:33:33 +00:00

src

feat(policy): add built-in KMS role policies and a negative authorization matrix (#5588 )

2026-08-01 19:33:33 +00:00

tests

feat(policy): parse and match KMS key resources with a kms:Decrypt action (#5515 )

2026-08-01 10:05:40 +08:00

AGENTS.md

docs: scope AGENTS instructions by directory (#2083 )

2026-03-05 17:25:37 +08:00

Cargo.toml

fix(ecstore): harden HotPath profiling boundaries (#5555 )

2026-08-01 08:49:48 +00:00

README.md

docs: fix some dead link (#1053 )

2025-12-08 11:23:24 +08:00

README.md

RustFS Policy - Policy Engine

Advanced policy engine and access control system for RustFS distributed object storage

📖 Documentation · 🐛 Bug Reports · 💬 Discussions

📖 Overview

RustFS Policy provides advanced policy engine and access control capabilities for the RustFS distributed object storage system. For the complete RustFS experience, please visit the main RustFS repository.

✨ Features

AWS-compatible bucket policy engine
Fine-grained resource-based access control
Condition-based policy evaluation
Policy validation and syntax checking
Role-based access control integration
Dynamic policy evaluation with context

📚 Documentation

For comprehensive documentation, examples, and usage guides, please visit the main RustFS repository.

📄 License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.