TrueCloudLab/policy-engine
19
0
Fork 10
generated from TrueCloudLab/basic
Code Issues 4 Pull requests Projects Releases Packages Wiki Activity Actions

[#80] iam: Skip unsupported conditions in native chains #80

Merged
dkirillov merged 1 commit from dkirillov/policy-engine:bugfix/skip_aws_condition_in_native_converters into master 2024-09-04 19:51:23 +00:00
Conversation 0 Commits 1 Files changed 3 +9 -4
dkirillov commented 2024-06-10 14:36:08 +00:00
Member
Copy link

Skip conditions with

  • aws:RequestTag
  • aws:ResourceTag
    keys

Signed-off-by: Denis Kirillov d.kirillov@yadro.com

Skip conditions with * aws:RequestTag * aws:ResourceTag keys Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>
dkirillov self-assigned this 2024-06-10 14:36:08 +00:00
dkirillov changed title from WIP: [#XX] iam: Skip unsupported conditions in native chains to WIP: [#80] iam: Skip unsupported conditions in native chains 2024-06-11 08:10:18 +00:00
dkirillov force-pushed bugfix/skip_aws_condition_in_native_converters from a5f3d51dcc to 64e06f5b7c 2024-06-11 08:15:41 +00:00 Compare
dkirillov requested review from storage-core-committers 2024-06-11 09:20:29 +00:00
dkirillov changed title from WIP: [#80] iam: Skip unsupported conditions in native chains to [#80] iam: Skip unsupported conditions in native chains 2024-06-11 09:20:39 +00:00
dkirillov requested review from storage-core-developers 2024-06-11 09:20:43 +00:00
dkirillov requested review from storage-services-developers 2024-06-11 09:20:57 +00:00
dkirillov requested review from storage-services-committers 2024-06-11 09:21:08 +00:00
alexvanin approved these changes 2024-06-11 10:00:44 +00:00
alexvanin left a comment
Owner
Copy link

Looks brilliant, see small question and comment suggestion.

Looks brilliant, see small question and comment suggestion.
iam/converter_native.go Outdated
@ -238,0 +243,4 @@
res.Conditions = append(res.Conditions, gr.Conditions[i])
case strings.HasPrefix(gr.Conditions[i].Key, condKeyAWSRequestTagPrefix) ||
strings.HasPrefix(gr.Conditions[i].Key, condKeyAWSResourceTagPrefix):
continue
alexvanin commented 2024-06-11 09:58:05 +00:00
Owner
Copy link

Small comment about the reason we skip these conditions will be nice, e.g.

Tags exist only in S3 requests, so native protocol should not process such conditions.
Small comment about the reason we skip these conditions will be nice, e.g. ``` Tags exist only in S3 requests, so native protocol should not process such conditions. ```
👍 1
alexvanin marked this conversation as resolved
iam/converter_s3.go Outdated
@ -181,1 +181,4 @@
case gr.Conditions[i].Key == condKeyAWSMFAPresent:
gr.Conditions[i].Key = s3.PropertyKeyAccessBoxAttrMFA
case strings.HasPrefix(gr.Conditions[i].Key, condKeyAWSResourceTagPrefix):
alexvanin commented 2024-06-11 10:00:14 +00:00
Owner
Copy link

We don't check condKeyAWSRequestTagPrefix unlike native converter because by default it goes to request condition?

We don't check `condKeyAWSRequestTagPrefix` unlike native converter because by default it goes to request condition?
dkirillov commented 2024-06-11 10:28:52 +00:00
Author
Member
Copy link

Yes

Yes
alexvanin marked this conversation as resolved
dkirillov force-pushed bugfix/skip_aws_condition_in_native_converters from bf60335380 to ac965e8d17 2024-06-11 10:29:48 +00:00 Compare
acid-ant approved these changes 2024-06-11 12:36:26 +00:00
dkirillov merged commit ac965e8d17 into master 2024-06-13 08:06:14 +00:00
dkirillov deleted branch bugfix/skip_aws_condition_in_native_converters 2024-06-13 08:06:24 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
alexvanin
acid-ant
TrueCloudLab/storage-core-developers
TrueCloudLab/storage-services-developers
Labels
Clear labels
  
Infrastructure

Infrastructure, Automation, CI/CD or DevOps related stuff

  
blocked

The issue or PR is blocked by something

  
bug

Something is not working

  
config

Configuration format update or breaking change

  
discussion

Talking about something in order to reach a decision or to exchange ideas

  
documentation

Documentation related

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
go

Language features adoption

  
help wanted

Extra attention is needed

  
internal

   
invalid

Something is wrong

  
kludge

This is a kludge and we know it

  
observability

Related to metrics, tracing and logs

  
perfomance

Perfomance related

  
question

More information is needed

  
refactoring

Refactoring

  
wontfix

This won't be fixed

No labels
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
dkirillov
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/policy-engine#80
No description provided.
Delete branch "dkirillov/policy-engine:bugfix/skip_aws_condition_in_native_converters"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?