[#36] iam: Support iam actions #36

Merged
alexvanin merged 2 commits from dkirillov/policy-engine:feature/support_iam_actions into master 2023-12-20 07:08:32 +00:00
5 changed files with 194 additions and 176 deletions

View file

@ -56,6 +56,7 @@ const (
arnIAMPrefix = "arn:aws:iam::"
s3ResourcePrefix = "arn:aws:s3:::"
s3ActionPrefix = "s3:"
iamActionPrefix = "iam:"
)
var (
@ -243,53 +244,38 @@ func parsePrincipalAsIAMUser(principal string) (account string, user string, err
return account, user, nil
}
func parseResourceAsS3ARN(resource string) (bucket string, object string, err error) {
func validateResource(resource string) error {
if resource == Wildcard {
return Wildcard, Wildcard, nil
return nil
}
if !strings.HasPrefix(resource, s3ResourcePrefix) {
return "", "", ErrInvalidResourceFormat
if !strings.HasPrefix(resource, s3ResourcePrefix) && !strings.HasPrefix(resource, arnIAMPrefix) {
return ErrInvalidResourceFormat
}
// iam arn format arn:aws:s3:::<bucket-name>/<object-name>
s3Resource := strings.TrimPrefix(resource, s3ResourcePrefix)
sepIndex := strings.Index(s3Resource, "/")
if sepIndex < 0 {
return s3Resource, "", nil
index := strings.IndexByte(resource, Wildcard[0])
if index != -1 && index != utf8.RuneCountInString(resource)-1 {
return ErrInvalidResourceFormat
}
bucket = s3Resource[:sepIndex]
object = s3Resource[sepIndex+1:]
if len(object) == 0 {
return bucket, Wildcard, nil
}
if bucket == Wildcard && object != Wildcard {
return "", "", ErrInvalidResourceFormat
}
return bucket, object, nil
return nil
}
func parseActionAsS3Action(action string) (string, error) {
func validateAction(action string) error {
if action == Wildcard {
return Wildcard, nil
return nil
}
if !strings.HasPrefix(action, s3ActionPrefix) {
return "", ErrInvalidActionFormat
if !strings.HasPrefix(action, s3ActionPrefix) && !strings.HasPrefix(action, iamActionPrefix) {
return ErrInvalidActionFormat
}
// iam arn format :s3:<action-name>
s3Action := strings.TrimPrefix(action, s3ActionPrefix)
index := strings.IndexByte(s3Action, Wildcard[0])
if index != -1 && index != utf8.RuneCountInString(s3Action)-1 {
return "", ErrInvalidActionFormat
index := strings.IndexByte(action, Wildcard[0])
if index != -1 && index != utf8.RuneCountInString(action)-1 {
return ErrInvalidActionFormat
}
return s3Action, nil
return nil
}
func splitGroupedConditions(groupedConditions []GroupedConditions) [][]chain.Condition {

View file

@ -3,6 +3,7 @@ package iam
import (
"errors"
"fmt"
"strings"
"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
"git.frostfs.info/TrueCloudLab/policy-engine/schema/native"
@ -22,11 +23,11 @@ var actionToOpMap = map[string][]string{
}
const (
supportedS3ActionDeleteObject = "DeleteObject"
supportedS3ActionGetObject = "GetObject"
supportedS3ActionHeadObject = "HeadObject"
supportedS3ActionPutObject = "PutObject"
supportedS3ActionListBucket = "ListBucket"
supportedS3ActionDeleteObject = "s3:DeleteObject"
supportedS3ActionGetObject = "s3:GetObject"
supportedS3ActionHeadObject = "s3:HeadObject"
supportedS3ActionPutObject = "s3:PutObject"
supportedS3ActionListBucket = "s3:ListBucket"
)
type NativeResolver interface {
@ -160,30 +161,50 @@ func formNativeResourceNamesAndConditions(names []string, resolver NativeResolve
var combined []string
for i := range names {
bkt, obj, err := parseResourceAsS3ARN(names[i])
if err != nil {
for _, resource := range names {
if err := validateResource(resource); err != nil {
return nil, err
}
if bkt == Wildcard {
if resource == Wildcard {
res = res[:0]
return append(res, GroupedResources{Names: []string{native.ResourceFormatAllObjects}}), nil
}
if !strings.HasPrefix(resource, s3ResourcePrefix) {
continue
}
var bkt, obj string
s3Resource := strings.TrimPrefix(resource, s3ResourcePrefix)
if s3Resource == Wildcard {
res = res[:0]
return append(res, GroupedResources{Names: []string{native.ResourceFormatAllObjects}}), nil
}
if sepIndex := strings.Index(s3Resource, "/"); sepIndex < 0 {
bkt = s3Resource
} else {
bkt = s3Resource[:sepIndex]
obj = s3Resource[sepIndex+1:]
if len(obj) == 0 {
obj = Wildcard
}
}
cnrID, err := resolver.GetBucketCID(bkt)
if err != nil {
return nil, err
}
resource := fmt.Sprintf(native.ResourceFormatRootContainerObjects, cnrID)
nativeResource := fmt.Sprintf(native.ResourceFormatRootContainerObjects, cnrID)
if obj == Wildcard || obj == "" {
combined = append(combined, resource)
combined = append(combined, nativeResource)
continue
}
res = append(res, GroupedResources{
Names: []string{resource},
Names: []string{nativeResource},
Conditions: []chain.Condition{
{
Op: chain.CondStringLike,
@ -232,14 +253,23 @@ func formPrincipalKey(principal string, resolver NativeResolver) (string, error)
func formNativeActionNames(names []string) ([]string, error) {
res := make([]string, 0, len(names))
for i := range names {
action, err := parseActionAsS3Action(names[i])
if err != nil {
for _, action := range names {
if err := validateAction(action); err != nil {
return nil, err
}
if action == Wildcard {
return []string{Wildcard}, nil
}
if !strings.HasPrefix(action, s3ActionPrefix) {
continue
}
if strings.TrimPrefix(action, s3ActionPrefix) == Wildcard {
return []string{Wildcard}, nil
}
res = append(res, actionToOpMap[action]...)
}

View file

@ -21,19 +21,17 @@ func ConvertToS3Chain(p Policy, resolver S3Resolver) (*chain.Chain, error) {
for _, statement := range p.Statement {
status := formStatus(statement)
action, actionInverted := statement.action()
s3Actions, err := formS3ActionNames(action)
if err != nil {
actions, actionInverted := statement.action()
if err := validateS3ActionNames(actions); err != nil {
return nil, err
}
ruleAction := chain.Actions{Inverted: actionInverted, Names: s3Actions}
ruleAction := chain.Actions{Inverted: actionInverted, Names: actions}
resource, resourceInverted := statement.resource()
s3Resources, err := formS3ResourceNames(resource)
if err != nil {
resources, resourceInverted := statement.resource()
if err := validateS3ResourceNames(resources); err != nil {
return nil, err
}
ruleResource := chain.Resources{Inverted: resourceInverted, Names: s3Resources}
ruleResource := chain.Resources{Inverted: resourceInverted, Names: resources}
groupedConditions, err := convertToS3ChainCondition(statement.Conditions, resolver)
if err != nil {
@ -141,33 +139,22 @@ func formPrincipalOwner(principal string, resolver S3Resolver) (string, error) {
return address, nil
}
func formS3ResourceNames(names []string) ([]string, error) {
res := make([]string, len(names))
func validateS3ResourceNames(names []string) error {
for i := range names {
bkt, obj, err := parseResourceAsS3ARN(names[i])
if err != nil {
return nil, err
if err := validateResource(names[i]); err != nil {
return err
}
}
if bkt == Wildcard || obj == "" {
res[i] = bkt
continue
}
res[i] = bkt + "/" + obj
}
return res, nil
return nil
}
func formS3ActionNames(names []string) ([]string, error) {
var err error
res := make([]string, len(names))
func validateS3ActionNames(names []string) error {
for i := range names {
if res[i], err = parseActionAsS3Action(names[i]); err != nil {
return nil, err
if err := validateAction(names[i]); err != nil {
return err
}
}
return res, nil
return nil
}

View file

@ -69,8 +69,8 @@ func TestConverters(t *testing.T) {
principal := "arn:aws:iam::" + namespace + ":user/" + userName
bktName := "DOC-EXAMPLE-BUCKET"
objName := "object-name"
resource := bktName + "/*"
action := "PutObject"
resource := fmt.Sprintf(s3.ResourceFormatS3BucketObjects, bktName)
s3action := "s3:PutObject"
mockResolver := newMockUserResolver([]string{user}, []string{bktName})
@ -83,7 +83,7 @@ func TestConverters(t *testing.T) {
},
Effect: AllowEffect,
Action: []string{"s3:PutObject"},
Resource: []string{"arn:aws:s3:::" + resource},
Resource: []string{resource},
Conditions: map[string]Condition{
CondStringEquals: {
"s3:RequestObjectTag/Department": {"Finance"},
@ -95,7 +95,7 @@ func TestConverters(t *testing.T) {
expected := &chain.Chain{Rules: []chain.Rule{
{
Status: chain.Allow,
Actions: chain.Actions{Names: []string{action}},
Actions: chain.Actions{Names: []string{s3action}},
Resources: chain.Resources{Names: []string{resource}},
Condition: []chain.Condition{
{
@ -128,14 +128,14 @@ func TestConverters(t *testing.T) {
},
Effect: AllowEffect,
Action: []string{"s3:PutObject"},
Resource: []string{"arn:aws:s3:::" + resource},
Resource: []string{resource},
}},
}
expected := &chain.Chain{Rules: []chain.Rule{
{
Status: chain.Allow,
Actions: chain.Actions{Names: []string{action}},
Actions: chain.Actions{Names: []string{native.MethodPutObject}},
Resources: chain.Resources{Names: []string{fmt.Sprintf(native.ResourceFormatRootContainerObjects, mockResolver.buckets[bktName])}},
Condition: []chain.Condition{
{
@ -162,14 +162,14 @@ func TestConverters(t *testing.T) {
},
Effect: DenyEffect,
NotAction: []string{"s3:PutObject"},
NotResource: []string{"arn:aws:s3:::" + resource},
NotResource: []string{resource},
}},
}
expected := &chain.Chain{Rules: []chain.Rule{
{
Status: chain.AccessDenied,
Actions: chain.Actions{Inverted: true, Names: []string{action}},
Actions: chain.Actions{Inverted: true, Names: []string{s3action}},
Resources: chain.Resources{Inverted: true, Names: []string{resource}},
Condition: []chain.Condition{
{
@ -196,14 +196,14 @@ func TestConverters(t *testing.T) {
},
Effect: DenyEffect,
NotAction: []string{"s3:GetObject"},
NotResource: []string{"arn:aws:s3:::" + bktName + "/" + objName},
NotResource: []string{fmt.Sprintf(s3.ResourceFormatS3BucketObject, bktName, objName)},
}},
}
expected := &chain.Chain{Rules: []chain.Rule{
{
Status: chain.AccessDenied,
Actions: chain.Actions{Inverted: true, Names: actionToOpMap["GetObject"]},
Actions: chain.Actions{Inverted: true, Names: actionToOpMap["s3:GetObject"]},
Resources: chain.Resources{Inverted: true, Names: []string{
fmt.Sprintf(native.ResourceFormatRootContainerObjects, mockResolver.buckets[bktName]),
}},
@ -278,6 +278,49 @@ func TestConverters(t *testing.T) {
_, err := ConvertToNativeChain(p, mockResolver)
require.Error(t, err)
})
t.Run("valid mixed iam/s3 actions", func(t *testing.T) {
p := Policy{
Statement: []Statement{{
Principal: map[PrincipalType][]string{AWSPrincipalType: {principal}},
Effect: AllowEffect,
Action: []string{"s3:PutObject", "iam:*"},
Resource: []string{"*"},
}},
}
s3Expected := &chain.Chain{Rules: []chain.Rule{{
Status: chain.Allow,
Actions: chain.Actions{Names: []string{"s3:PutObject", "iam:*"}},
Resources: chain.Resources{Names: []string{"*"}},
Condition: []chain.Condition{{
Op: chain.CondStringEquals,
Object: chain.ObjectRequest,
Key: s3.PropertyKeyOwner,
Value: mockResolver.users[user],
}},
}}}
s3Chain, err := ConvertToS3Chain(p, mockResolver)
require.NoError(t, err)
require.Equal(t, s3Expected, s3Chain)
nativeExpected := &chain.Chain{Rules: []chain.Rule{{
Status: chain.Allow,
Actions: chain.Actions{Names: []string{native.MethodPutObject}},
Resources: chain.Resources{Names: []string{native.ResourceFormatAllObjects}},
Condition: []chain.Condition{{
Op: chain.CondStringEquals,
Object: chain.ObjectRequest,
Key: native.PropertyKeyActorPublicKey,
Value: mockResolver.users[user],
}},
}}}
nativeChain, err := ConvertToNativeChain(p, mockResolver)
require.NoError(t, err)
require.Equal(t, nativeExpected, nativeChain)
})
}
func TestConvertToChainCondition(t *testing.T) {
@ -566,7 +609,7 @@ func TestComplexNativeConditions(t *testing.T) {
}
expectedStatus := chain.AccessDenied
expectedActions := chain.Actions{Names: actionToOpMap[action]}
expectedActions := chain.Actions{Names: actionToOpMap["s3:"+action]}
expectedResource1 := chain.Resources{Names: []string{nativeResource1}}
expectedResource23 := chain.Resources{Names: []string{nativeResource2, nativeResource3}}
@ -849,10 +892,10 @@ func TestComplexS3Conditions(t *testing.T) {
principal2 := "arn:aws:iam::" + namespace + ":user/" + userName2
bktName1, bktName2, bktName3 := "bktName", "bktName2", "bktName3"
objName1 := "objName1"
resource1 := bktName1 + "/" + objName1
resource2 := bktName2 + "/*"
resource3 := bktName3 + "/*"
action := "PutObject"
resource1 := fmt.Sprintf(s3.ResourceFormatS3BucketObject, bktName1, objName1)
resource2 := fmt.Sprintf(s3.ResourceFormatS3BucketObjects, bktName2)
resource3 := fmt.Sprintf(s3.ResourceFormatS3BucketObjects, bktName3)
action := "s3:PutObject"
key1, key2 := "key1", "key2"
val0, val1, val2 := "val0", "val1", "val2"
@ -866,8 +909,8 @@ func TestComplexS3Conditions(t *testing.T) {
AWSPrincipalType: {principal1, principal2},
},
Effect: DenyEffect,
Action: []string{"s3:" + action},
Resource: []string{"arn:aws:s3:::" + resource1, "arn:aws:s3:::" + resource2, "arn:aws:s3:::" + resource3},
Action: []string{action},
Resource: []string{resource1, resource2, resource3},
Conditions: map[string]Condition{
CondStringEquals: {key1: {val0, val1}},
CondStringLike: {key2: {val2}},
@ -876,7 +919,7 @@ func TestComplexS3Conditions(t *testing.T) {
}
expectedStatus := chain.AccessDenied
expectedActions := chain.Actions{Names: actionToOpMap[action]}
expectedActions := chain.Actions{Names: []string{action}}
expectedResources := chain.Resources{Names: []string{resource1, resource2, resource3}}
user1Condition := chain.Condition{Op: chain.CondStringEquals, Object: chain.ObjectRequest, Key: s3.PropertyKeyOwner, Value: mockResolver.users[user1]}
@ -958,7 +1001,7 @@ func TestComplexS3Conditions(t *testing.T) {
{
name: "bucket resource3, all conditions matched",
action: action,
resource: bktName3 + "/some-obj",
resource: fmt.Sprintf(s3.ResourceFormatS3BucketObject, bktName3, "some-obj"),
requestMap: map[string]string{
s3.PropertyKeyOwner: mockResolver.users[user1],
key1: val0,
@ -969,7 +1012,7 @@ func TestComplexS3Conditions(t *testing.T) {
{
name: "bucket resource, user condition mismatched",
action: action,
resource: bktName2 + "/some-obj",
resource: fmt.Sprintf(s3.ResourceFormatS3BucketObject, bktName2, "some-obj"),
requestMap: map[string]string{
key1: val0,
key2: val2,
@ -979,7 +1022,7 @@ func TestComplexS3Conditions(t *testing.T) {
{
name: "bucket resource, key2 condition mismatched",
action: action,
resource: bktName3 + "/some-obj",
resource: fmt.Sprintf(s3.ResourceFormatS3BucketObject, bktName3, "some-obj"),
requestMap: map[string]string{
s3.PropertyKeyOwner: mockResolver.users[user1],
key1: val0,
@ -990,7 +1033,7 @@ func TestComplexS3Conditions(t *testing.T) {
{
name: "bucket resource, key1 condition mismatched",
action: action,
resource: bktName2 + "/some-obj",
resource: fmt.Sprintf(s3.ResourceFormatS3BucketObject, bktName2, "some-obj"),
requestMap: map[string]string{
s3.PropertyKeyOwner: mockResolver.users[user1],
key2: val2,
@ -1011,7 +1054,7 @@ func TestComplexS3Conditions(t *testing.T) {
{
name: "bucket/object resource, resource mismatched",
action: action,
resource: bktName1 + "/some-obj",
resource: fmt.Sprintf(s3.ResourceFormatS3BucketObject, bktName1, "some-obj"),
requestMap: map[string]string{
s3.PropertyKeyOwner: mockResolver.users[user1],
key1: val0,
@ -1054,7 +1097,7 @@ func TestComplexS3Conditions(t *testing.T) {
{
name: "resource mismatched",
action: action,
resource: "some-bkt/some-obj",
resource: fmt.Sprintf(s3.ResourceFormatS3BucketObject, "some-bkt", "some-obj"),
requestMap: map[string]string{
s3.PropertyKeyOwner: mockResolver.users[user1],
key1: val0,
@ -1077,7 +1120,7 @@ func TestS3BucketResource(t *testing.T) {
bktName1, bktName2 := "bucket1", "bucket2"
chainName := chain.Name("name")
mockResolver := newMockUserResolver([]string{}, []string{bktName1})
mockResolver := newMockUserResolver([]string{}, []string{})
p := Policy{
Version: "2012-10-17",
@ -1086,13 +1129,13 @@ func TestS3BucketResource(t *testing.T) {
Principal: map[PrincipalType][]string{Wildcard: nil},
Effect: DenyEffect,
Action: []string{"s3:HeadBucket"},
Resource: []string{"arn:aws:s3:::" + bktName1},
Resource: []string{fmt.Sprintf(s3.ResourceFormatS3Bucket, bktName1)},
},
{
Principal: map[PrincipalType][]string{Wildcard: nil},
Effect: AllowEffect,
Action: []string{"*"},
Resource: []string{"arn:aws:s3:::*"},
Resource: []string{s3.ResourceFormatS3All},
},
},
}
@ -1105,19 +1148,19 @@ func TestS3BucketResource(t *testing.T) {
require.NoError(t, err)
// check we match just "bucket1" resource
req := testutil.NewRequest("HeadBucket", testutil.NewResource(bktName1, nil), nil)
req := testutil.NewRequest("s3:HeadBucket", testutil.NewResource(fmt.Sprintf(s3.ResourceFormatS3Bucket, bktName1), nil), nil)
status, _, err := s.IsAllowed(chainName, engine.NewRequestTargetWithNamespace(namespace), req)
require.NoError(t, err)
require.Equal(t, chain.AccessDenied.String(), status.String())
// check we match just "bucket2" resource
req = testutil.NewRequest("HeadBucket", testutil.NewResource(bktName2, nil), nil)
req = testutil.NewRequest("s3:HeadBucket", testutil.NewResource(fmt.Sprintf(s3.ResourceFormatS3Bucket, bktName2), nil), nil)
status, _, err = s.IsAllowed(chainName, engine.NewRequestTargetWithNamespace(namespace), req)
require.NoError(t, err)
require.Equal(t, chain.Allow.String(), status.String())
// check we also match "bucket2/object" resource
req = testutil.NewRequest("PutObject", testutil.NewResource(bktName2+"/object", nil), nil)
req = testutil.NewRequest("s3:PutObject", testutil.NewResource(fmt.Sprintf(s3.ResourceFormatS3BucketObject, bktName2, "object"), nil), nil)
status, _, err = s.IsAllowed(chainName, engine.NewRequestTargetWithNamespace(namespace), req)
require.NoError(t, err)
require.Equal(t, chain.Allow.String(), status.String())
@ -1140,50 +1183,45 @@ func TestWildcardConverters(t *testing.T) {
func TestActionParsing(t *testing.T) {
for _, tc := range []struct {
action string
expected string
err bool
}{
{
action: "withoutPrefix",
expected: "",
err: true,
},
{
action: "s3:*Object",
expected: "",
err: true,
},
{
action: "*",
expected: "*",
},
{
action: "s3:PutObject",
expected: "PutObject",
},
{
action: "s3:Put*",
expected: "Put*",
},
{
action: "s3:*",
expected: "*",
},
{
action: "s3:",
expected: "",
},
{
action: "iam:ListAccessKeys",
},
{
action: "iam:*",
},
} {
t.Run("", func(t *testing.T) {
actual, err := parseActionAsS3Action(tc.action)
err := validateAction(tc.action)
if tc.err {
require.Error(t, err)
return
}
} else {
require.NoError(t, err)
require.Equal(t, tc.expected, actual)
}
})
}
}
@ -1254,54 +1292,23 @@ func TestPrincipalParsing(t *testing.T) {
func TestResourceParsing(t *testing.T) {
for _, tc := range []struct {
resource string
expectedBucket string
expectedObject string
err bool
}{
{
resource: "withoutPrefixAnd",
err: true,
},
{
resource: "arn:aws:s3:::*/obj",
err: true,
},
{
resource: "arn:aws:s3:::bkt/*",
expectedBucket: "bkt",
expectedObject: "*",
},
{
resource: "arn:aws:s3:::bkt",
expectedBucket: "bkt",
expectedObject: "",
},
{
resource: "arn:aws:s3:::bkt/",
expectedBucket: "bkt",
expectedObject: "*",
},
{
resource: "arn:aws:s3:::*",
expectedBucket: "*",
expectedObject: "",
},
{
resource: "*",
expectedBucket: "*",
expectedObject: "*",
},
{resource: "withoutPrefixAnd", err: true},
{resource: "arn:aws:s3:::*/obj", err: true},
{resource: "arn:aws:s3:::bkt/*"},
{resource: "arn:aws:s3:::bkt"},
{resource: "arn:aws:s3:::bkt/"},
{resource: "arn:aws:s3:::*"},
{resource: "*"},
} {
t.Run("", func(t *testing.T) {
bkt, obj, err := parseResourceAsS3ARN(tc.resource)
err := validateResource(tc.resource)
if tc.err {
require.Error(t, err)
return
}
} else {
require.NoError(t, err)
require.Equal(t, tc.expectedBucket, bkt)
require.Equal(t, tc.expectedObject, obj)
}
})
}
}

View file

@ -6,4 +6,12 @@ const (
PropertyKeyDelimiter = "s3:delimiter"
PropertyKeyPrefix = "s3:prefix"
PropertyKeyVersionID = "s3:VersionId"
ResourceFormatS3All = "arn:aws:s3:::*"
ResourceFormatS3Bucket = "arn:aws:s3:::%s"
ResourceFormatS3BucketObjects = "arn:aws:s3:::%s/*"
ResourceFormatS3BucketObject = "arn:aws:s3:::%s/%s"
ResourceFormatIAMNamespaceUser = "arn:aws:iam::%s:user/%s"
ResourceFormatIAMNamespaceGroup = "arn:aws:iam::%s:group/%s"
)