Zhengchao An fc3896f479 feat(policy): add built-in KMS role policies and a negative authorization matrix (#5588) ...

* feat(policy): add built-in KMS role policies

KMSKeyAdministrator, KMSKeyUser and KMSAuditor ship as canned identity
policies so operators can express KMS role separation without hand-writing
the resource grammar. They grant only kms actions, so they compose with an
existing data-plane policy, and none of them confers kms:Configure,
kms:ServiceControl, kms:ClearCache, kms:Backup or kms:Restore.

* docs(kms): document per-key KMS authorization and the role templates

* test(kms): add an end-to-end negative authorization matrix

Covers the admin and SSE-KMS planes for a wrong identity, a wrong key, a
wrong action and an explicit Deny, each preceded by a positive control so a
denial cannot be an unpropagated policy. SSE-S3 and unencrypted objects are
asserted to stay exempt.

* test(replication): pin the SSE-KMS contract with per-key authorization on

The replication worker carries no request identity, so it must stay exempt
from SSE-KMS key authorization. Running the existing contract with the
switch enabled makes a regression in that exemption visible here.

2026-08-01 19:33:33 +00:00

..

architecture

fix(storage): harden scanner and recovery edge cases (#5521)

2026-08-01 03:25:13 +00:00

operations

feat(policy): add built-in KMS role policies and a negative authorization matrix (#5588)

2026-08-01 19:33:33 +00:00

testing

fix(sts): align AssumeRole authorization (#5281)

2026-08-01 11:48:58 +08:00