TrueCloudLab
/
policy-engine
generated from TrueCloudLab/basic
18
0
Fork 8
Code Issues 2 Pull Requests 2 Actions Packages Projects Releases Wiki Activity
policy-engine/docs/policy_converters.md

16 KiB
Raw Blame History

Policy converters

This repository contains converters that provide opportunities to transform AWS IAM policies to inner FrostFS policy format. This document describes such transformations.

FrostFS

As it was mentioned there are converters that transform AWS IAM policies to FrostFS. Here common examples of AWS:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": "*"
    }
  ]
}

and FrostFS:

{
  "ID": "c29tZS1pZA==",
  "Rules": [
    {
      "Status": "Allow",
      "Actions": {
        "Inverted": false,
        "Names": [
          "s3:*"
        ]
      },
      "Resources": {
        "Inverted": false,
        "Names": [
          "*"
        ]
      },
      "Any": false,
      "Condition": null
    }
  ],
  "MatchType": "DenyPriority"
}

policies.

Despite there is only one FrostFS format, we have two converters (s3 and native). The reason is S3 gateway and Storage node have different actions and resource naming:

  • S3 has a lot of methods and operates with bucket/object
  • Storage node has only 6 container and 7 object methods and operates container/object (that has different format)

The following sections describe each transformation more precisely (common sections contains shared concepts)

Common

Fields

Rough json main fields mapping:

AWS policy field FrostFS policy field Comment
Version - Not applicable
Statement Rules
Effect Status
Action Actions.Names Actions.Inverted = false
NotAction Actions.Names Actions.Inverted = true
Resource Resources.Names Resources.Inverted = false
NotResource Resources.Names Resources.Inverted = true
Condition Condition Any = false, that means the conditions must be hold altogether
Principal - Expressed via conditions (depends on s3/native converters)

Conditions

Each condition in FrostFS policy can add requirements to some request/resource properties and consists of the following fields:

Field Description
Op Condition type operation (StringEqual, NumericEqual etc)
Object Property type to which condition can be applied (Request property, Resource property)
Key Property key
Value Property value

Conditions operators:

AWS conditions operator FrostFS condition operator Comment
StringEquals StringEquals
StringNotEquals StringNotEquals
StringEqualsIgnoreCase StringEqualsIgnoreCase
StringNotEqualsIgnoreCase StringNotEqualsIgnoreCase
StringLike StringLike
StringNotLike StringNotLike
NumericEquals NumericEquals
NumericNotEquals NumericNotEquals
NumericLessThan NumericLessThan
NumericLessThanEquals NumericLessThanEquals
NumericGreaterThan NumericGreaterThan
NumericGreaterThanEquals NumericGreaterThanEquals
DateEquals StringEquals Date transforms to unix timestamp to be compared as string
DateNotEquals StringNotEquals Date transforms to unix timestamp to be compared as string
DateLessThan StringEqualsIgnoreCase Date transforms to unix timestamp to be compared as string
DateLessThanEquals StringNotEqualsIgnoreCase Date transforms to unix timestamp to be compared as string
DateGreaterThan StringLike Date transforms to unix timestamp to be compared as string
DateGreaterThanEquals StringNotLike Date transforms to unix timestamp to be compared as string
Bool StringEqualsIgnoreCase
IpAddress IPAddress
NotIpAddress NotIPAddress
ArnEquals StringEquals
ArnLike StringLike
ArnNotEquals StringNotEquals
ArnNotLike StringNotLike
SliceContains SliceContains AWS spec doesn't contain such operator. This is FrostFS extension

For example, AWS conditions:

{
  "Condition": {
    "ArnEquals": {"key16": ["val16"]},
    "ArnNotEquals": {"key18": ["val18"]},
    "ArnNotLike": {"key19": ["val19"]},
    "Bool": {"key13": ["True"]},
    "DateEquals": {"key7": ["2006-01-02T15:04:05+07:00"]},
    "DateGreaterThan": {"key11": ["2006-01-02T15:04:05-01:00"]},
    "DateGreaterThanEquals": {"key12": ["2006-01-02T15:04:05-03:00"]},
    "DateLessThan": {"key9": ["2006-01-02T15:04:05+06:00"]},
    "DateLessThanEquals": {"key10": ["2006-01-02T15:04:05+03:00"]},
    "DateNotEquals": {"key8": ["2006-01-02T15:04:05Z"]},
    "NumericEquals": {"key20": ["-20"]},
    "NumericGreaterThan": {"key24": ["-24.24"]},
    "NumericGreaterThanEquals": {"key25": ["+25.25"]},
    "NumericLessThan": {"key22": ["0"]},
    "NumericLessThanEquals": {"key23": ["23.23"]},
    "NumericNotEquals": {"key21": ["+21"]},
    "StringEquals": {"key1": ["val0"]},
    "StringEqualsIgnoreCase": {"key3": ["val3"]},
    "StringLike": {"key5": ["val5"]},
    "StringNotEquals": {"key2": ["val2"]},
    "StringNotEqualsIgnoreCase": {"key4": ["val4"]},
    "StringNotLike": {"key6": ["val6"]}
  }
}

transforms to FrostFS conditions:

{
  "Condition": [
    {"Op": "StringLike", "Object": "Request", "Key": "key5", "Value": "val5"},
    {"Op": "StringNotEquals", "Object": "Request", "Key": "key2", "Value": "val2"},
    {"Op": "StringGreaterThan", "Object": "Request", "Key": "key11", "Value": "1136217845"},
    {"Op": "StringGreaterThanEquals", "Object": "Request", "Key": "key12", "Value": "1136225045"},
    {"Op": "StringLessThan", "Object": "Request", "Key": "key9", "Value": "1136192645"},
    {"Op": "StringEqualsIgnoreCase", "Object": "Request", "Key": "key3", "Value": "val3"},
    {"Op": "StringEquals", "Object": "Request", "Key": "key16", "Value": "val16"},
    {"Op": "NumericLessThanEquals", "Object": "Request", "Key": "key23", "Value": "23.23"},
    {"Op": "StringNotEqualsIgnoreCase", "Object": "Request", "Key": "key4", "Value": "val4"},
    {"Op": "StringEquals", "Object": "Request", "Key": "key1", "Value": "val0"},
    {"Op": "StringLessThanEquals", "Object": "Request", "Key": "key10", "Value": "1136203445"},
    {"Op": "NumericGreaterThan", "Object": "Request", "Key": "key24", "Value": "-24.24"},
    {"Op": "NumericGreaterThanEquals", "Object": "Request", "Key": "key25", "Value": "+25.25"},
    {"Op": "NumericLessThan", "Object": "Request", "Key": "key22", "Value": "0"},
    {"Op": "StringNotEquals", "Object": "Request", "Key": "key8", "Value": "1136214245"},
    {"Op": "NumericEquals", "Object": "Request", "Key": "key20", "Value": "-20"},
    {"Op": "NumericNotEquals", "Object": "Request", "Key": "key21", "Value": "+21"},
    {"Op": "StringNotLike", "Object": "Request", "Key": "key6", "Value": "val6"},
    {"Op": "StringNotEquals", "Object": "Request", "Key": "key18", "Value": "val18"},
    {"Op": "StringNotLike", "Object": "Request", "Key": "key19", "Value": "val19"},
    {"Op": "StringEqualsIgnoreCase", "Object": "Request", "Key": "key13", "Value": "True"},
    {"Op": "StringEquals", "Object": "Request", "Key": "key7", "Value": "1136189045"}
  ]
}

S3

Actions

Each action allows some s3-gw methods, so we must transform action to specific method names (you can see exact mapping in table in this file).

For example the following actions:

{
  "Action": [
    "s3:DeleteObject",
    "iam:CreateUser"
  ]
}

transforms to

{
  "Actions": {
    "Inverted": false,
    "Names": [
      "s3:DeleteObject",
      "s3:DeleteMultipleObjects",
      "iam:CreateUser"
    ]
  }
}

As we can see any iam:* action transformed as it is. But s3:* actions transforms according to spec rules and s3-gw method names.

Resources

Resource is transformed as it is:

{
  "Resource": [
    "arn:aws:s3:::bucket/object"
  ]
}

{
  "Resources": {
    "Inverted": false,
    "Names": [
      "arn:aws:s3:::bucket/object"
    ]
  }
}

Principals

To check user s3-gw uses special condition request property (Owner), so when AWS policy contains principal field it transforms to rule with appropriate condition. To get correct Owner property value special user resolver (S3Resolver interface in converter_s3 file) must be provided into convert function.

For example such AWS json statement:

{
  "Effect": "Allow",
  "Action": "*",
  "Resource": "*",
  "Principal": {
    "AWS": "arn:aws:iam::111122223333:user/JohnDoe"
  }
}

transforms to the following FrostFS rule:

{
  "Status": "Allow",
  "Actions": {
    "Inverted": false,
    "Names": [
      "*"
    ]
  },
  "Resources": {
    "Inverted": false,
    "Names": [
      "*"
    ]
  },
  "Any": false,
  "Condition": [
    {
      "Op": "StringEquals",
      "Object": "Request",
      "Key": "Owner",
      "Value": "NbUgTSFvPmsRxmGeWpuuGeJUoRoi6PErcM"
    }
  ]
}

Native

Actions

Each action allows some frostfs methods, so we must transform action to specific method names (you can see exact mapping in table in this file).

For example the following actions:

{
  "Action": [
    "s3:DeleteObject",
    "iam:CreateUser"
  ]
}

transforms to

{
  "Actions": {
    "Inverted": false,
    "Names": [
      "PutObject",
      "HeadObject",
      "GetObject",
      "RangeObject",
      "GetContainer",
      "DeleteObject"
    ]
  }
}

Note: Only subset of s3:* actions can be transformed (exact value you can see in mapping table mentioned before). If all provided actions is not applicable converter function returns appropriate error.

Native methods (to which original actions are transformed) depend on which methods are invoked by appropriate s3-gw method.

So in example above s3-gw during performing DeleteObject methods invokes the following methods: ["PutObject","HeadObject","GetObject","RangeObject","GetContainer","DeleteObject"]

Resources

To transform resources the following is being performed:

  • Bucket name is resoled to container id (by providing NativeResolver interface implementation to converter)
  • Object name is transformed to condition with special FilePath attribute (that present on every object that was uploaded via s3-gw)

For example, the following AWS policy statement:

{
  "Principal": "*",
  "Effect": "Allow",
  "Action": "*",
  "Resource": "arn:aws:s3:::bucket/object"
}

transforms to FrostFS native policy rule:

{
  "Status": "Allow",
  "Actions": {
    "Inverted": false,
    "Names": [
      "*"
    ]
  },
  "Resources": {
    "Inverted": false,
    "Names": [
      "native:object//bucket/HFq67qbfhFEiEL7qDXqayo3F78yAvxXSXzwSa2hKM9bH/*",
      "native:container//bucket/HFq67qbfhFEiEL7qDXqayo3F78yAvxXSXzwSa2hKM9bH"
    ]
  },
  "Any": false,
  "Condition": [
    {
      "Op": "StringLike",
      "Object": "Resource",
      "Key": "FilePath",
      "Value": "object"
    }
  ]
}

Principals

To check user s3-gw uses special condition request property ($Actor:publicKey), so when AWS policy contains principal field it transforms to rule with appropriate condition. To get correct $Actor:publicKey property value special user resolver (NativeResolver interface in converter_native file) must be provided into convert function.

For example such AWS json statement:

{
  "Effect": "Allow",
  "Action": "*",
  "Resource": "*",
  "Principal": {
    "AWS": "arn:aws:iam::111122223333:user/JohnDoe"
  }
}

transforms to the following FrostFS rule:

{
  "Status": "Allow",
  "Actions": {
    "Inverted": false,
    "Names": [
      "*"
    ]
  },
  "Resources": {
    "Inverted": false,
    "Names": [
      "native:object/*",
      "native:container/*"
    ]
  },
  "Any": false,
  "Condition": [
    {
      "Op": "StringEquals",
      "Object": "Request",
      "Key": "$Actor:publicKey",
      "Value": "031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a"
    }
  ]
}