diff options
| author | Chris Lu <chrislusf@users.noreply.github.com> | 2025-11-12 22:14:50 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-11-12 22:14:50 -0800 |
| commit | 508d06d9a5c763668ba149a8f1182e8552505c2b (patch) | |
| tree | a34d21d801d2b71dc3c6968cbb4ff8568e0fa8da /test/s3/iam/iam_config.github.json | |
| parent | 50f067bcfd99ecf1821ba2d34fc2f109e90428bb (diff) | |
| download | seaweedfs-508d06d9a5c763668ba149a8f1182e8552505c2b.tar.xz seaweedfs-508d06d9a5c763668ba149a8f1182e8552505c2b.zip | |
S3: Enforce bucket policy (#7471)
* evaluate policies during authorization
* cache bucket policy
* refactor
* matching with regex special characters
* Case Sensitivity, pattern cache, Dead Code Removal
* Fixed Typo, Restored []string Case, Added Cache Size Limit
* hook up with policy engine
* remove old implementation
* action mapping
* validate
* if not specified, fall through to IAM checks
* fmt
* Fail-close on policy evaluation errors
* Explicit `Allow` bypasses IAM checks
* fix error message
* arn:seaweed => arn:aws
* remove legacy support
* fix tests
* Clean up bucket policy after this test
* fix for tests
* address comments
* security fixes
* fix tests
* temp comment out
Diffstat (limited to 'test/s3/iam/iam_config.github.json')
| -rw-r--r-- | test/s3/iam/iam_config.github.json | 40 |
1 files changed, 20 insertions, 20 deletions
diff --git a/test/s3/iam/iam_config.github.json b/test/s3/iam/iam_config.github.json index b9a2fface..7a903b047 100644 --- a/test/s3/iam/iam_config.github.json +++ b/test/s3/iam/iam_config.github.json @@ -35,25 +35,25 @@ { "claim": "roles", "value": "s3-admin", - "role": "arn:seaweed:iam::role/KeycloakAdminRole" + "role": "arn:aws:iam::role/KeycloakAdminRole" }, { "claim": "roles", "value": "s3-read-only", - "role": "arn:seaweed:iam::role/KeycloakReadOnlyRole" + "role": "arn:aws:iam::role/KeycloakReadOnlyRole" }, { "claim": "roles", "value": "s3-write-only", - "role": "arn:seaweed:iam::role/KeycloakWriteOnlyRole" + "role": "arn:aws:iam::role/KeycloakWriteOnlyRole" }, { "claim": "roles", "value": "s3-read-write", - "role": "arn:seaweed:iam::role/KeycloakReadWriteRole" + "role": "arn:aws:iam::role/KeycloakReadWriteRole" } ], - "defaultRole": "arn:seaweed:iam::role/KeycloakReadOnlyRole" + "defaultRole": "arn:aws:iam::role/KeycloakReadOnlyRole" } } } @@ -64,7 +64,7 @@ "roles": [ { "roleName": "TestAdminRole", - "roleArn": "arn:seaweed:iam::role/TestAdminRole", + "roleArn": "arn:aws:iam::role/TestAdminRole", "trustPolicy": { "Version": "2012-10-17", "Statement": [ @@ -82,7 +82,7 @@ }, { "roleName": "TestReadOnlyRole", - "roleArn": "arn:seaweed:iam::role/TestReadOnlyRole", + "roleArn": "arn:aws:iam::role/TestReadOnlyRole", "trustPolicy": { "Version": "2012-10-17", "Statement": [ @@ -100,7 +100,7 @@ }, { "roleName": "TestWriteOnlyRole", - "roleArn": "arn:seaweed:iam::role/TestWriteOnlyRole", + "roleArn": "arn:aws:iam::role/TestWriteOnlyRole", "trustPolicy": { "Version": "2012-10-17", "Statement": [ @@ -118,7 +118,7 @@ }, { "roleName": "KeycloakAdminRole", - "roleArn": "arn:seaweed:iam::role/KeycloakAdminRole", + "roleArn": "arn:aws:iam::role/KeycloakAdminRole", "trustPolicy": { "Version": "2012-10-17", "Statement": [ @@ -136,7 +136,7 @@ }, { "roleName": "KeycloakReadOnlyRole", - "roleArn": "arn:seaweed:iam::role/KeycloakReadOnlyRole", + "roleArn": "arn:aws:iam::role/KeycloakReadOnlyRole", "trustPolicy": { "Version": "2012-10-17", "Statement": [ @@ -154,7 +154,7 @@ }, { "roleName": "KeycloakWriteOnlyRole", - "roleArn": "arn:seaweed:iam::role/KeycloakWriteOnlyRole", + "roleArn": "arn:aws:iam::role/KeycloakWriteOnlyRole", "trustPolicy": { "Version": "2012-10-17", "Statement": [ @@ -172,7 +172,7 @@ }, { "roleName": "KeycloakReadWriteRole", - "roleArn": "arn:seaweed:iam::role/KeycloakReadWriteRole", + "roleArn": "arn:aws:iam::role/KeycloakReadWriteRole", "trustPolicy": { "Version": "2012-10-17", "Statement": [ @@ -220,8 +220,8 @@ "s3:ListBucket" ], "Resource": [ - "arn:seaweed:s3:::*", - "arn:seaweed:s3:::*/*" + "arn:aws:s3:::*", + "arn:aws:s3:::*/*" ] }, { @@ -243,8 +243,8 @@ "s3:*" ], "Resource": [ - "arn:seaweed:s3:::*", - "arn:seaweed:s3:::*/*" + "arn:aws:s3:::*", + "arn:aws:s3:::*/*" ] }, { @@ -254,8 +254,8 @@ "s3:ListBucket" ], "Resource": [ - "arn:seaweed:s3:::*", - "arn:seaweed:s3:::*/*" + "arn:aws:s3:::*", + "arn:aws:s3:::*/*" ] }, { @@ -277,8 +277,8 @@ "s3:*" ], "Resource": [ - "arn:seaweed:s3:::*", - "arn:seaweed:s3:::*/*" + "arn:aws:s3:::*", + "arn:aws:s3:::*/*" ] }, { |