TrueCloudLab/policy-engine
20
0
Fork 11
generated from TrueCloudLab/basic
Code Issues 5 Pull requests 1 Projects Releases Packages Wiki Activity Actions

[#80] iam: Skip unsupported conditions in native chains #80

Merged
dkirillov merged 1 commit from dkirillov/policy-engine:bugfix/skip_aws_condition_in_native_converters into master 2024-09-04 19:51:23 +00:00
Conversation 0 Commits 1 Files changed 3 +9 -4
3 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
iam/converter_native.go
View file

@ -243,6 +243,7 @@ func convertToNativeChainCondition(c Conditions, resolver NativeResolver) ([]Gro
res.Conditions = append(res.Conditions, gr.Conditions[i])
case strings.HasPrefix(gr.Conditions[i].Key, condKeyAWSRequestTagPrefix) ||
strings.HasPrefix(gr.Conditions[i].Key, condKeyAWSResourceTagPrefix):
// Tags exist only in S3 requests, so native protocol should not process such conditions.
alexvanin marked this conversation as resolved Outdated
alexvanin commented 2024-06-11 09:58:05 +00:00
Outdated
Review
Copy link

Small comment about the reason we skip these conditions will be nice, e.g.

Tags exist only in S3 requests, so native protocol should not process such conditions.
Small comment about the reason we skip these conditions will be nice, e.g. ``` Tags exist only in S3 requests, so native protocol should not process such conditions. ```
👍 1
continue
default:
res.Conditions = append(res.Conditions, gr.Conditions[i])

10
iam/converter_s3.go
View file

@ -2,6 +2,7 @@ package iam
import (
"fmt"
"strings"
"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
"git.frostfs.info/TrueCloudLab/policy-engine/schema/s3"
@ -169,16 +170,19 @@ func getS3PrincipalsAndConditionFunc(statement Statement, resolver S3Resolver) (
func convertToS3ChainCondition(c Conditions, resolver S3Resolver) ([]GroupedConditions, error) {
return convertToChainConditions(c, func(gr GroupedConditions) (GroupedConditions, error) {
for i := range gr.Conditions {
if gr.Conditions[i].Key == condKeyAWSPrincipalARN {
switch {
case gr.Conditions[i].Key == condKeyAWSPrincipalARN:
gr.Conditions[i].Key = s3.PropertyKeyOwner
val, err := formPrincipalOwner(gr.Conditions[i].Value, resolver)
if err != nil {
return GroupedConditions{}, err
}
gr.Conditions[i].Value = val
}
if gr.Conditions[i].Key == condKeyAWSMFAPresent {
case gr.Conditions[i].Key == condKeyAWSMFAPresent:
gr.Conditions[i].Key = s3.PropertyKeyAccessBoxAttrMFA
case strings.HasPrefix(gr.Conditions[i].Key, condKeyAWSResourceTagPrefix):
alexvanin marked this conversation as resolved Outdated
alexvanin commented 2024-06-11 10:00:14 +00:00
Outdated
Review
Copy link

We don't check condKeyAWSRequestTagPrefix unlike native converter because by default it goes to request condition?

We don't check `condKeyAWSRequestTagPrefix` unlike native converter because by default it goes to request condition?
dkirillov commented 2024-06-11 10:28:52 +00:00
Outdated
Review
Copy link

Yes

Yes
gr.Conditions[i].Kind = chain.KindResource
}
}

2
iam/converter_test.go
View file

@ -1705,7 +1705,7 @@ func TestTagsConditions(t *testing.T) {
},
{
Op: chain.CondStringEquals,
Kind: chain.KindRequest,
Kind: chain.KindResource,
Key: fmt.Sprintf(s3.PropertyKeyFormatResourceTag, "owner"),
Value: "hr-admin",
},