[#87 ] iam: Support s3:PatchObject action

Signed-off-by: Marina Biryukova <m.biryukova@yadro.com>
[#91 ] lint: Fix warnings
2024-08-22 10:41:52 +00:00 · 2024-08-22 12:22:32 +03:00 · 2024-08-22 12:22:15 +03:00 · 2024-08-21 07:20:38 +00:00 · 2024-08-20 17:17:17 +03:00 · 2024-08-19 09:37:38 +03:00
35 changed files with 2426 additions and 500 deletions
--- a/.forgejo/workflows/dco.yml
+++ b/.forgejo/workflows/dco.yml
@ -13,7 +13,7 @@ jobs:
      - name: Setup Go
        uses: actions/setup-go@v3
        with:
-          go-version: '1.21'
+          go-version: '1.23'

      - name: Run commit format checker
        uses: https://git.frostfs.info/TrueCloudLab/dco-go@v3
--- a/.forgejo/workflows/tests.yml
+++ b/.forgejo/workflows/tests.yml
@ -11,7 +11,7 @@ jobs:
      - name: Set up Go
        uses: actions/setup-go@v3
        with:
-          go-version: '1.21'
+          go-version: '1.23'
          cache: true

      - name: Install linters
@ -25,7 +25,7 @@ jobs:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        go_versions: [ '1.20', '1.21' ]
+        go_versions: [ '1.22', '1.23' ]
      fail-fast: false
    steps:
      - uses: actions/checkout@v3
@ -48,7 +48,7 @@ jobs:
      - name: Set up Go
        uses: actions/setup-go@v3
        with:
-          go-version: '1.21'
+          go-version: '1.23'
          cache: true

      - name: Run tests
@ -63,7 +63,7 @@ jobs:
      - name: Set up Go
        uses: actions/setup-go@v3
        with:
-          go-version: '1.21'
+          go-version: '1.23'
          cache: true

      - name: Install staticcheck
--- a/.golangci.yml
+++ b/.golangci.yml
@ -12,7 +12,8 @@ run:
 # output configuration options
 output:
  # colored-line-number|line-number|json|tab|checkstyle|code-climate, default is "colored-line-number"
-  format: tab
+  formats:
+    - format: tab

 # all available settings of specific linters
 linters-settings:
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@ -2,13 +2,6 @@ ci:
  autofix_prs: false

 repos:
-  - repo: https://github.com/jorisroovers/gitlint
-    rev:  v0.19.1
-    hooks:
-      - id: gitlint
-        stages: [commit-msg]
-      - id: gitlint-ci
-
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.4.0
    hooks:
@ -42,7 +35,7 @@ repos:
    hooks:
       - id: go-unit-tests
         name: go unit tests
-         entry: make test
+         entry: make test GOFLAGS=''
         pass_filenames: false
         types: [go]
         language: system
--- a/7
+++ b/7
@ -1,9 +1,9 @@
 #!/usr/bin/make -f

-TRUECLOUDLAB_LINT_VERSION ?= 0.0.2
+TRUECLOUDLAB_LINT_VERSION ?= 0.0.6
 TMP_DIR := .cache
 OUTPUT_LINT_DIR ?= $(shell pwd)/bin
-LINT_VERSION ?= 1.55.1
+LINT_VERSION ?= 1.60.1
 LINT_DIR = $(OUTPUT_LINT_DIR)/golangci-lint-$(LINT_VERSION)-v$(TRUECLOUDLAB_LINT_VERSION)
 EASYJSON_VERSION ?= $(shell go list -f '{{.Version}}' -m github.com/mailru/easyjson)
 EASYJSON_DIR ?= $(shell pwd)/bin/easyjson-$(EASYJSON_VERSION)
@ -22,9 +22,10 @@ imports:
 	@goimports -w .

 # Run Unit Test with go test
+test: GOFLAGS ?= "-count=1"
 test:
 	@echo "⇒ Running go test"
-	@go test ./... -count=1
+	@GOFLAGS="$(GOFLAGS)" go test ./...

 # Activate pre-commit hooks
 pre-commit:
--- a/docs/ape.md
+++ b/docs/ape.md
@ -0,0 +1,85 @@
+# Access policy engine
+
+## General overview
+
+### Purpose
+
+Access policy engine (APE) is aimed at checking if a request can be performed over a resource by looking up the set chains of rules.
+
+#### Terms
+
+| Term           | Description                                                    | Structure overview     |
+| -------------- | -------------------------------------------------------------- | -------------- |
+| `Request`      | The action that is being performed on the `Resource`.                          | <ul><li>`Operation` - `GetObject`,`PutObject` etc.;</li><li>`Properties` - actor's public key, actor's attributes;</li><li>`Resource`.</li></ul> |
+| `Resource`     | The object that the request is being performed on. Check also [resource.md](./resource.md).   |  <ul><li>`Name` - strictly formatted string value;</li><li>`Properties`.</li></ul> |
+| `Chain`        | A chain of `Rule`-s defined for a specific target. Chains are strictly distinguished by `Name`-s , i.e. chains with name `ingress` are not intersected with chains with name `s3`. Chains are stored in serialized format.       | <ul><li>Base64-encoded `ID`;</li><li>List of `Rule`-s;</li><li>`MatchType` - defines rule status selection priority.</li></ul> |
+| `Rule`         | `Rule` defines which status is returned if `Request` matches all conditions.                                                         | <ul><li>`Status`: `Allow`, `AccessDenied`, `QuotaLimitReached`, `NoRuleFound`;</li><li>`Actions` - operation defined by a schema (`GetObject`, `PutContainer` etc.);</li><li>`Resources`;</li><li>`Any` - if `true` then `Reqeust` matches `Rule` if any `Condition` is `true`;</li><li>`Conditions`.</li></ul> |
+| `Name`   | `Name` of a chain (do not confuse with chain ID). `Name` defines a layer of `Chain`'s usage, so chains are distinguished by `Name`-s. Basically, `Name` refers to a protocol.                                                       | String value (`ingress`, `s3`, `iam`).      |
+| `Target`       | A scope of request. `Target` can be either simple (only namespace; only container; only user; only groups) or compound (namespace + container). | <ul><li>`Namespace`;</li><li>`Container`;</li><li>`User`;</li><li>`Groups`.</li></ul> |
+| `Engine`       | `Engine` checks a request in a scope defined by `Target`. First, it is trying to match a request with rules defined in `LocalOverrideStorage` and, then, in `MorphRuleChainStorage`.                                                          | <ul><li>`LocalOverrideStorage` - chains stored in the local override storage have the highest priority</li><li>`MorphRuleChainStorage` - basically, chains stored in `Policy` contract;</li><li>`ChainRouter` - looks up chains and try to match them with `Request`.</li></ul> |
+
+#### Details
+
+Here some entities are overviewed in more detail.
+
+##### Resource
+
+`Resource`'s name is strictly formatted, the format is defined by a schema (`native`, `aws` etc.). Examples:
+
+```bash
+# The resource is the particular object with the address within Root namespace
+native:object//HRwWbb1bJjRms33kkA21hy4JdPfARaH3fW9NfuNN6Fgj/EbxzAdz5LB4uqxuz6crWKAumBNtZyK2rKsqQP7TdZvwr
+# The resource is all objects within the container within Root namespace
+native:object//HRwWbb1bJjRms33kkA21hy4JdPfARaH3fW9NfuNN6Fgj/*
+# The resource is the particular container within the namespace
+native:container/namespace1/HRwWbb1bJjRms33kkA21hy4JdPfARaH3fW9NfuNN6Fgj
+# The resource is all containers within the namespace
+native:container/namespace1/*
+```
+
+##### Rule
+
+`Rule` works out if:
+
+ 1. a requests's operation matches the rule's `Actions`;
+ 2. resource name matches the rule's `Resources`;
+ 3. if all (or at least one if `Any=true`) conditions in `Condition` is met. Each condition defines how to retrieve
+and compare the retrieved value. If `Condition`'s `Object` is set to `Resource` then the value is retrieved from the
+resource's properties (example: container zone attribute). If `Object` is set to `Request`, the it's retrieved from the request's properties (example: actor's public key).
+
+###### Name matching
+
+`Resource`'s name in `Rule` may contain wildcard '*' that can be considered as a regular expression:
+
+```bash
+# The resource is all objects within the container within Root namespace
+native:object//HRwWbb1bJjRms33kkA21hy4JdPfARaH3fW9NfuNN6Fgj/*
+```
+
+If an incoming request has such a resource name, then names are matched:
+
+```bash
+# The resource is all objects within the container within Root namespace
+native:object//HRwWbb1bJjRms33kkA21hy4JdPfARaH3fW9NfuNN6Fgj/EbxzAdz5LB4uqxuz6crWKAumBNtZyK2rKsqQP7TdZvwr
+```
+
+If the incoming request has such a resource name that specifies a container's object within namespace, for instance, `namespicy`,
+then matching does not work out:
+
+```bash
+# The resource is all objects within the container within `namespicy` namespace:
+native:object/namespicy/HRwWbb1bJjRms33kkA21hy4JdPfARaH3fW9NfuNN6Fgj/EbxzAdz5LB4uqxuz6crWKAumBNtZyK2rKsqQP7TdZvwr
+```
+
+##### Engine
+
+`Engine` is trying to match the request against **the target** looking up chain rules, firstly, in `LocalOverrideStorage` (these rules are also known as *local overrides*) and then in `MorphRuleChainStorage` (contract `Policy`). Both storages iterate chain rules according to the specified priority of the targets: `namespace` -> `container` -> `user` -> `groups`.
+
+#### Diagrams
+
+The diagram demonstrates a scenario in Storage node. The request `A` cannot be performed as APE matched
+the request and returned `Access Denied` status. The request `B` is allowed and the client gets `OK` status.  
+![Storage node](images/ape/storage_node_ape.svg)
+
+The diagram demonstrates a complex scenario with S3, IAM and Storage node.
+![S3 and IAM](images/ape/s3_ape.svg)
--- a/docs/images/ape/s3_ape.puml
+++ b/docs/images/ape/s3_ape.puml
@ -0,0 +1,61 @@
+@startuml s3 ape
+
+participant "Client" as client
+
+participant "IAM" as iam
+participant "IAM -> APE converter" as converter
+
+box "S3" #HotPink
+  participant "S3 gateway" as s3
+end box
+
+box "Access Policy Engine (as s3 middleware)" #LightPink
+  participant "Local override storage" as s3localOverrides
+  participant "Chain router" as s3chainRouter
+end box
+
+box "Policy contract (shared)" 
+  participant "Morph rule storage" as morphRuleStorage
+end box
+
+box "Access Policy Engine (as storage middleware)" #LightGreen
+  participant "Chain Router" as storageChainRouter
+  participant "Local override storage" as storageLocalOverrides
+end box
+
+box "Storage node" #Green
+  participant "Object service" as obj
+  participant "Control service" as control
+end box
+
+group Request IAM to set a policy
+  client -> iam : Set IAM policy
+  iam -> converter : Convert IAM policy
+  converter -> iam : Return APE chain
+  iam -> morphRuleStorage : Store IAM policy and APE chain
+  iam -> s3localOverrides : Set S3 local overrides
+  iam -> client : OK
+end
+
+group Request S3 to set a policy
+  client -> s3 : Set bucket policy
+  s3 -> converter : Convert IAM policy
+  converter -> s3 : Return APE chain
+  s3 -> morphRuleStorage : Store bucket policy and APE chain
+  s3 -> client : OK
+end
+
+group Get object
+  client -> s3: GetObject
+  s3 -> s3chainRouter: Check if APE allows request for S3
+  note over s3chainRouter: matching the request with overrides and rules
+  s3chainRouter -> s3: Status: ALLOW
+  s3 -> obj: Get object
+  obj -> storageChainRouter: Check if APE allows the request
+  note over storageChainRouter : matching the request with overrides and rules
+  storageChainRouter -> obj: Status: ALLOW
+  obj -> s3: Response: OK, Object
+  s3 -> client: Response: OK, Object
+end
+
+@enduml
--- a/docs/images/ape/s3_ape.svg
+++ b/docs/images/ape/s3_ape.svg
--- a/docs/images/ape/storage_node_ape.puml
+++ b/docs/images/ape/storage_node_ape.puml
@ -0,0 +1,46 @@
+@startuml storage node ape
+!pragma teoz true
+
+participant "Administrator" as administrator
+participant "Client" as client
+
+box "Storage node" #Green
+  participant "Object service" as obj
+  participant "Control service" as control
+end box
+
+box "Access Policy Engine" #LightGreen
+  participant "Local override storage" as localOverrides
+  participant "Chain Router" as chainRouter
+  participant "Morph rule storage" as morphRuleStorage
+end box
+
+group Set local override
+  client -> control: Add local override
+  control -> localOverrides: Save override in DB
+  localOverrides -> control: OK
+  control -> client: OK
+end
+
+group Update state in Policy contract
+  administrator -> morphRuleStorage: Add chain
+  morphRuleStorage -> administrator: OK
+end
+
+group Perform a request A
+  client -> obj : Sending a request
+  obj -> chainRouter: Check if APE allows the request
+  note over chainRouter : Fetches local overrides and rules defined for a target/targets and looks for a match
+  chainRouter -> obj: APE returns status: "ACCESS DENIED"
+  obj -> client: Response: "the request is denied"
+end
+
+group Perform a request B
+  client -> obj : Sending a request
+  obj -> chainRouter: Check if APE allows the request
+  note over chainRouter : Fetches local overrides and rules defined for a target/targets and looks for a match
+  chainRouter -> obj: APE returns status: "ALLOW"
+  obj -> client: Response: "OK"
+end
+
+@enduml
--- a/docs/images/ape/storage_node_ape.svg
+++ b/docs/images/ape/storage_node_ape.svg
--- a/docs/policy_converters.md
+++ b/docs/policy_converters.md
@ -0,0 +1,439 @@
+# Policy converters
+
+This repository contains converters that provide opportunities to
+transform [AWS IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html) to inner
+FrostFS policy format. This document describes such transformations.
+
+## FrostFS
+
+As it was mentioned there are converters that transform AWS IAM policies to FrostFS.
+Here common examples of AWS:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:*"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+and FrostFS:
+
+```json
+{
+  "ID": "c29tZS1pZA==",
+  "Rules": [
+    {
+      "Status": "Allow",
+      "Actions": {
+        "Inverted": false,
+        "Names": [
+          "s3:*"
+        ]
+      },
+      "Resources": {
+        "Inverted": false,
+        "Names": [
+          "*"
+        ]
+      },
+      "Any": false,
+      "Condition": null
+    }
+  ],
+  "MatchType": "DenyPriority"
+}
+```
+
+policies.
+
+Despite there is only one FrostFS format, we have two converters (`s3` and `native`). The reason is S3 gateway and
+Storage node have different actions and resource naming:
+
+* S3 has [a lot of methods](https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html) and operates with
+  bucket/object
+* Storage node has only 6 container and 7 object methods and operates container/object (that has different format)
+
+The following sections describe each transformation more precisely ([common](#common) sections contains shared concepts)
+
+### Common
+
+#### Fields
+
+Rough json main fields mapping:
+
+| AWS policy field | FrostFS policy field | Comment                                                          |
+|------------------|----------------------|------------------------------------------------------------------|
+| `Version`        | -                    | Not applicable                                                   |
+| `Statement`      | `Rules`              |                                                                  |
+| `Effect`         | `Status`             |                                                                  |
+| `Action`         | `Actions.Names`      | `Actions.Inverted` = false                                       |
+| `NotAction`      | `Actions.Names`      | `Actions.Inverted` = true                                        |
+| `Resource`       | `Resources.Names`    | `Resources.Inverted` = false                                     |
+| `NotResource`    | `Resources.Names`    | `Resources.Inverted` = true                                      |
+| `Condition`      | `Condition`          | `Any` = false, that means the conditions must be hold altogether |
+| `Principal`      | -                    | Expressed via conditions (depends on s3/native converters)       |
+
+### Conditions
+
+Each condition in FrostFS policy can add requirements to some request/resource properties
+and consists of the following fields:
+
+| Field    | Description                                                                               |
+|----------|-------------------------------------------------------------------------------------------|
+| `Op`     | Condition type operation (`StringEqual`, `NumericEqual` etc)                              |                                                                   
+| `Object` | Property type to which condition can be applied (`Request` property, `Resource` property) |                                                                   
+| `Key`    | Property key                                                                              |                                                                   
+| `Value`  | Property value                                                                            |                                                                   
+
+Conditions operators:
+
+| AWS conditions operator     | FrostFS condition operator  | Comment                                                           |
+|-----------------------------|-----------------------------|-------------------------------------------------------------------|
+| `StringEquals`              | `StringEquals`              |                                                                   |
+| `StringNotEquals`           | `StringNotEquals`           |                                                                   |
+| `StringEqualsIgnoreCase`    | `StringEqualsIgnoreCase`    |                                                                   |
+| `StringNotEqualsIgnoreCase` | `StringNotEqualsIgnoreCase` |                                                                   |
+| `StringLike`                | `StringLike`                |                                                                   |
+| `StringNotLike`             | `StringNotLike`             |                                                                   |
+| `NumericEquals`             | `NumericEquals`             |                                                                   |
+| `NumericNotEquals`          | `NumericNotEquals`          |                                                                   |
+| `NumericLessThan`           | `NumericLessThan`           |                                                                   |
+| `NumericLessThanEquals`     | `NumericLessThanEquals`     |                                                                   |
+| `NumericGreaterThan`        | `NumericGreaterThan`        |                                                                   |
+| `NumericGreaterThanEquals`  | `NumericGreaterThanEquals`  |                                                                   |
+| `DateEquals`                | `StringEquals`              | Date transforms to unix timestamp to be compared as string        |
+| `DateNotEquals`             | `StringNotEquals`           | Date transforms to unix timestamp to be compared as string        |
+| `DateLessThan`              | `StringEqualsIgnoreCase`    | Date transforms to unix timestamp to be compared as string        |
+| `DateLessThanEquals`        | `StringNotEqualsIgnoreCase` | Date transforms to unix timestamp to be compared as string        |
+| `DateGreaterThan`           | `StringLike`                | Date transforms to unix timestamp to be compared as string        |
+| `DateGreaterThanEquals`     | `StringNotLike`             | Date transforms to unix timestamp to be compared as string        |
+| `Bool`                      | `StringEqualsIgnoreCase`    |                                                                   |
+| `IpAddress`                 | `IPAddress`                 |                                                                   |
+| `NotIpAddress`              | `NotIPAddress`              |                                                                   |
+| `ArnEquals`                 | `StringEquals`              |                                                                   |
+| `ArnLike`                   | `StringLike`                |                                                                   |
+| `ArnNotEquals`              | `StringNotEquals`           |                                                                   |
+| `ArnNotLike`                | `StringNotLike`             |                                                                   |
+| `SliceContains`             | `SliceContains`             | AWS spec doesn't contain such operator. This is FrostFS extension |
+
+For example, AWS conditions:
+
+```json
+{
+  "Condition": {
+    "ArnEquals": {"key16": ["val16"]},
+    "ArnNotEquals": {"key18": ["val18"]},
+    "ArnNotLike": {"key19": ["val19"]},
+    "Bool": {"key13": ["True"]},
+    "DateEquals": {"key7": ["2006-01-02T15:04:05+07:00"]},
+    "DateGreaterThan": {"key11": ["2006-01-02T15:04:05-01:00"]},
+    "DateGreaterThanEquals": {"key12": ["2006-01-02T15:04:05-03:00"]},
+    "DateLessThan": {"key9": ["2006-01-02T15:04:05+06:00"]},
+    "DateLessThanEquals": {"key10": ["2006-01-02T15:04:05+03:00"]},
+    "DateNotEquals": {"key8": ["2006-01-02T15:04:05Z"]},
+    "NumericEquals": {"key20": ["-20"]},
+    "NumericGreaterThan": {"key24": ["-24.24"]},
+    "NumericGreaterThanEquals": {"key25": ["+25.25"]},
+    "NumericLessThan": {"key22": ["0"]},
+    "NumericLessThanEquals": {"key23": ["23.23"]},
+    "NumericNotEquals": {"key21": ["+21"]},
+    "StringEquals": {"key1": ["val0"]},
+    "StringEqualsIgnoreCase": {"key3": ["val3"]},
+    "StringLike": {"key5": ["val5"]},
+    "StringNotEquals": {"key2": ["val2"]},
+    "StringNotEqualsIgnoreCase": {"key4": ["val4"]},
+    "StringNotLike": {"key6": ["val6"]}
+  }
+}
+```
+
+transforms to FrostFS conditions:
+
+```json
+{
+  "Condition": [
+    {"Op": "StringLike", "Object": "Request", "Key": "key5", "Value": "val5"},
+    {"Op": "StringNotEquals", "Object": "Request", "Key": "key2", "Value": "val2"},
+    {"Op": "StringGreaterThan", "Object": "Request", "Key": "key11", "Value": "1136217845"},
+    {"Op": "StringGreaterThanEquals", "Object": "Request", "Key": "key12", "Value": "1136225045"},
+    {"Op": "StringLessThan", "Object": "Request", "Key": "key9", "Value": "1136192645"},
+    {"Op": "StringEqualsIgnoreCase", "Object": "Request", "Key": "key3", "Value": "val3"},
+    {"Op": "StringEquals", "Object": "Request", "Key": "key16", "Value": "val16"},
+    {"Op": "NumericLessThanEquals", "Object": "Request", "Key": "key23", "Value": "23.23"},
+    {"Op": "StringNotEqualsIgnoreCase", "Object": "Request", "Key": "key4", "Value": "val4"},
+    {"Op": "StringEquals", "Object": "Request", "Key": "key1", "Value": "val0"},
+    {"Op": "StringLessThanEquals", "Object": "Request", "Key": "key10", "Value": "1136203445"},
+    {"Op": "NumericGreaterThan", "Object": "Request", "Key": "key24", "Value": "-24.24"},
+    {"Op": "NumericGreaterThanEquals", "Object": "Request", "Key": "key25", "Value": "+25.25"},
+    {"Op": "NumericLessThan", "Object": "Request", "Key": "key22", "Value": "0"},
+    {"Op": "StringNotEquals", "Object": "Request", "Key": "key8", "Value": "1136214245"},
+    {"Op": "NumericEquals", "Object": "Request", "Key": "key20", "Value": "-20"},
+    {"Op": "NumericNotEquals", "Object": "Request", "Key": "key21", "Value": "+21"},
+    {"Op": "StringNotLike", "Object": "Request", "Key": "key6", "Value": "val6"},
+    {"Op": "StringNotEquals", "Object": "Request", "Key": "key18", "Value": "val18"},
+    {"Op": "StringNotLike", "Object": "Request", "Key": "key19", "Value": "val19"},
+    {"Op": "StringEqualsIgnoreCase", "Object": "Request", "Key": "key13", "Value": "True"},
+    {"Op": "StringEquals", "Object": "Request", "Key": "key7", "Value": "1136189045"}
+  ]
+}
+```
+
+### S3
+
+#### Actions
+
+Each action allows some s3-gw methods, so we must transform action to specific method names
+(you can see exact mapping in table in [this file](../iam/converter_s3.go)).
+
+For example the following actions:
+
+```json
+{
+  "Action": [
+    "s3:DeleteObject",
+    "iam:CreateUser"
+  ]
+}
+```
+
+transforms to
+
+```json
+{
+  "Actions": {
+    "Inverted": false,
+    "Names": [
+      "s3:DeleteObject",
+      "s3:DeleteMultipleObjects",
+      "iam:CreateUser"
+    ]
+  }
+}
+```
+
+As we can see any `iam:*` action transformed as it is. But `s3:*` actions transforms according to
+[spec rules](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html) and s3-gw
+[method names](https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/src/commit/2ab655b909c40db6f7a4e41e07d8b99167f791bd/api/middleware/constants.go#L3-L76).
+
+#### Resources
+
+Resource is transformed as it is:
+
+```json
+{
+  "Resource": [
+    "arn:aws:s3:::bucket/object"
+  ]
+}
+```
+
+```json
+{
+  "Resources": {
+    "Inverted": false,
+    "Names": [
+      "arn:aws:s3:::bucket/object"
+    ]
+  }
+}
+```
+
+#### Principals
+
+To check user s3-gw uses special condition request property (`Owner`), so when AWS policy contains principal field
+it transforms to rule with appropriate condition. To get correct `Owner` property value special user resolver
+(`S3Resolver` interface in [converter_s3 file](../iam/converter_s3.go)) must be provided into convert function.
+
+For example such AWS json statement:
+
+```json
+{
+  "Effect": "Allow",
+  "Action": "*",
+  "Resource": "*",
+  "Principal": {
+    "AWS": "arn:aws:iam::111122223333:user/JohnDoe"
+  }
+}
+```
+
+transforms to the following FrostFS rule:
+
+```json
+{
+  "Status": "Allow",
+  "Actions": {
+    "Inverted": false,
+    "Names": [
+      "*"
+    ]
+  },
+  "Resources": {
+    "Inverted": false,
+    "Names": [
+      "*"
+    ]
+  },
+  "Any": false,
+  "Condition": [
+    {
+      "Op": "StringEquals",
+      "Object": "Request",
+      "Key": "Owner",
+      "Value": "NbUgTSFvPmsRxmGeWpuuGeJUoRoi6PErcM"
+    }
+  ]
+}
+```
+
+### Native
+
+#### Actions
+
+Each action allows some frostfs methods, so we must transform action to specific method names
+(you can see exact mapping in table in [this file](../iam/converter_native.go)).
+
+For example the following actions:
+
+```json
+{
+  "Action": [
+    "s3:DeleteObject",
+    "iam:CreateUser"
+  ]
+}
+```
+
+transforms to
+
+```json
+{
+  "Actions": {
+    "Inverted": false,
+    "Names": [
+      "PutObject",
+      "HeadObject",
+      "GetObject",
+      "RangeObject",
+      "GetContainer",
+      "DeleteObject"
+    ]
+  }
+}
+```
+
+> **Note:** Only subset of s3:* actions can be transformed (exact value you can see in mapping table mentioned before).
+> If all provided actions is not applicable converter function returns appropriate error.
+
+Native methods (to which original actions are transformed) depend on which methods are invoked by appropriate s3-gw
+[method](https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/src/commit/2ab655b909c40db6f7a4e41e07d8b99167f791bd/api/middleware/constants.go#L3-L76).
+
+So in example above s3-gw during performing DeleteObject methods invokes the following methods:
+`["PutObject","HeadObject","GetObject","RangeObject","GetContainer","DeleteObject"]`
+
+#### Resources
+
+To transform resources the following is being performed:
+
+* Bucket name is resoled to container id (by providing `NativeResolver` interface implementation to converter)
+* Object name is transformed to condition with special `FilePath` attribute
+  (that present on every object that was uploaded via s3-gw)
+
+For example, the following AWS policy statement:
+
+```json
+{
+  "Principal": "*",
+  "Effect": "Allow",
+  "Action": "*",
+  "Resource": "arn:aws:s3:::bucket/object"
+}
+```
+
+transforms to FrostFS native policy rule:
+
+```json
+{
+  "Status": "Allow",
+  "Actions": {
+    "Inverted": false,
+    "Names": [
+      "*"
+    ]
+  },
+  "Resources": {
+    "Inverted": false,
+    "Names": [
+      "native:object//bucket/HFq67qbfhFEiEL7qDXqayo3F78yAvxXSXzwSa2hKM9bH/*",
+      "native:container//bucket/HFq67qbfhFEiEL7qDXqayo3F78yAvxXSXzwSa2hKM9bH"
+    ]
+  },
+  "Any": false,
+  "Condition": [
+    {
+      "Op": "StringLike",
+      "Object": "Resource",
+      "Key": "FilePath",
+      "Value": "object"
+    }
+  ]
+}
+```
+
+#### Principals
+
+To check user s3-gw uses special condition request property (`$Actor:publicKey`), so when AWS policy contains principal
+field it transforms to rule with appropriate condition. To get correct `$Actor:publicKey` property value
+special user resolver (`NativeResolver` interface in [converter_native file](../iam/converter_native.go)) must be
+provided into convert function.
+
+For example such AWS json statement:
+
+```json
+{
+  "Effect": "Allow",
+  "Action": "*",
+  "Resource": "*",
+  "Principal": {
+    "AWS": "arn:aws:iam::111122223333:user/JohnDoe"
+  }
+}
+```
+
+transforms to the following FrostFS rule:
+
+```json
+{
+  "Status": "Allow",
+  "Actions": {
+    "Inverted": false,
+    "Names": [
+      "*"
+    ]
+  },
+  "Resources": {
+    "Inverted": false,
+    "Names": [
+      "native:object/*",
+      "native:container/*"
+    ]
+  },
+  "Any": false,
+  "Condition": [
+    {
+      "Op": "StringEquals",
+      "Object": "Request",
+      "Key": "$Actor:publicKey",
+      "Value": "031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a"
+    }
+  ]
+}
+```
--- a/go.mod
+++ b/go.mod
@ -1,9 +1,9 @@
 module git.frostfs.info/TrueCloudLab/policy-engine

-go 1.20
+go 1.22

 require (
-	git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.0
+	git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.3-0.20240409111539-e7a05a49ff45
 	github.com/google/uuid v1.3.1
 	github.com/mailru/easyjson v0.7.7
 	github.com/nspcc-dev/neo-go v0.105.0
--- a/go.sum
+++ b/go.sum
@ -1,11 +1,17 @@
-git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.0 h1:FzurjElUwC7InY9v5rzXReKbfBL5yRJKSWJPq6BKhH0=
-git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.0/go.mod h1:F/fe1OoIDKr5Bz99q4sriuHDuf3aZefZy9ZsCqEtgxc=
+git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.3-0.20240409111539-e7a05a49ff45 h1:Tp4I+XOLp3VCJORfxSamQtj3RZNISbaLM4WD5iIzXxg=
+git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.3-0.20240409111539-e7a05a49ff45/go.mod h1:F/fe1OoIDKr5Bz99q4sriuHDuf3aZefZy9ZsCqEtgxc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bits-and-blooms/bitset v1.8.0 h1:FD+XqgOZDUxxZ8hzoBFuV9+cGWY9CslN6d5MS5JVb4c=
+github.com/bits-and-blooms/bitset v1.8.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/consensys/bavard v0.1.13 h1:oLhMLOFGTLdlda/kma4VOJazblc7IM5y5QPd2A/YjhQ=
+github.com/consensys/bavard v0.1.13/go.mod h1:9ItSMtA/dXMAiL7BG6bqW2m3NdSEObYWoH223nGHukI=
 github.com/consensys/gnark-crypto v0.12.2-0.20231013160410-1f65e75b6dfb h1:f0BMgIjhZy4lSRHCXFbQst85f5agZAjtDMixQqBWNpc=
+github.com/consensys/gnark-crypto v0.12.2-0.20231013160410-1f65e75b6dfb/go.mod h1:v2Gy7L/4ZRosZ7Ivs+9SfUDr0f5UlG+EM5t7MPHiLuY=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decred/dcrd/crypto/blake256 v1.0.0/go.mod h1:sQl2p6Y26YV+ZOcSTP6thNdn47hh8kt6rqSlvmrXFAc=
@ -22,6 +28,7 @@ github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:W
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/snappy v0.0.1 h1:Qgr9rKW7uDUkrbSmQeiDsGa8SjGyCOGtuasMWwvp2P4=
 github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@ -30,16 +37,20 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
 github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
+github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/hashicorp/golang-lru v0.6.0 h1:uL2shRDx7RTrOrTCUZEGP/wJUFiUI8QT6E7z5o8jga4=
 github.com/hashicorp/golang-lru v0.6.0/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/holiman/uint256 v1.2.0 h1:gpSYcPLWGv4sG43I2mVLiDZCNDh/EpGjSk8tmtxitHM=
+github.com/holiman/uint256 v1.2.0/go.mod h1:y4ga/t+u+Xwd7CpDgZESaRcWy0I7XMlTMA25ApIH5Jw=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mmcloughlin/addchain v0.4.0 h1:SobOdjm2xLj1KkXN5/n0xTIWyZA2+s99UCY1iPfkHRY=
+github.com/mmcloughlin/addchain v0.4.0/go.mod h1:A86O+tHqZLMNO4w6ZZ4FlVQEadcoqkyU72HC5wJ4RlU=
 github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
 github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
 github.com/nspcc-dev/go-ordered-json v0.0.0-20231123160306-3374ff1e7a3c h1:OOQeE613BH93ICPq3eke5N78gWNeMjcBWkmD2NKyXVg=
@ -62,11 +73,17 @@ github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1y
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v1.13.0 h1:b71QUfeo5M8gq2+evJdTPfZhYMAU0uKPkyPJ7TPsloU=
+github.com/prometheus/client_golang v1.13.0/go.mod h1:vTeo+zgvILHsnnj/39Ou/1fPN5nJFOEMgftOUOmlvYQ=
 github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M=
+github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/common v0.37.0 h1:ccBbHCgIiT9uSoFY0vX8H3zsNR5eLt17/RQLUvn8pXE=
+github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
 github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5mo=
+github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
 github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/syndtr/goleveldb v1.0.1-0.20210305035536-64b5b1c73954 h1:xQdMZ1WLrgkkvOZ/LDQxjVxMLdby7osSh4ZEVa5sIjs=
@ -74,11 +91,13 @@ github.com/syndtr/goleveldb v1.0.1-0.20210305035536-64b5b1c73954/go.mod h1:u2MKk
 github.com/twmb/murmur3 v1.1.5 h1:i9OLS9fkuLzBXjt6dptlAEyk58fJsSTXbRg3SgVyqgk=
 github.com/twmb/murmur3 v1.1.5/go.mod h1:Qq/R7NUyOfr65zD+6Q5IHKsJLwP7exErjN6lyyq3OSQ=
 github.com/urfave/cli v1.22.5 h1:lNq9sAHXK2qfdI8W+GRItjCEkI+2oR4d+MEHy1CKXoU=
+github.com/urfave/cli v1.22.5/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74 h1:JwtAtbp7r/7QSyGz8mKUbYJBg2+6Cd7OjM8o/GNOcVo=
 github.com/virtuald/go-ordered-json v0.0.0-20170621173500-b18e6e673d74/go.mod h1:RmMWU37GKR2s6pgrIEB4ixgpVCt/cf7dnJv3fuH1J1c=
 go.etcd.io/bbolt v1.3.8 h1:xs88BrvEv273UsB79e0hcVrlUWmS0a8upikMFhSyAtA=
 go.etcd.io/bbolt v1.3.8/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
 go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
+go.uber.org/goleak v1.2.0/go.mod h1:XJYK+MuIchqpmGmUSAzotztawfKvYLUIgg7guXrwVUo=
 go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
 go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
@ -90,11 +109,13 @@ golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq
 golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63 h1:m64FZMko/V45gv0bNmrNYoDEq8U5YUhetc9cBWKS1TQ=
 golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63/go.mod h1:0v4NqG35kSWCMzLaMeX+IQrlSnVE/bqGSyC2cz/9Le8=
 golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200813134508-3edf25e44fcc/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
@ -111,6 +132,7 @@ golang.org/x/sys v0.0.0-20200814200057-3d37ad5750ed/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
+golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@ -118,6 +140,7 @@ golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.12.1-0.20230815132531-74c255bcf846 h1:Vve/L0v7CXXuxUmaMGIEK/dEeq7uiqb5qBgQrZzIE7E=
+golang.org/x/tools v0.12.1-0.20230815132531-74c255bcf846/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@ -128,6 +151,7 @@ google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miE
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
@ -139,3 +163,4 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 rsc.io/tmplfunc v0.0.3 h1:53XFQh69AfOa8Tw0Jm7t+GV7KZhOi6jzsCzTtKbMvzU=
+rsc.io/tmplfunc v0.0.3/go.mod h1:AG3sTPzElb1Io3Yg4voV9AGZJuleGAwaVRxL9M49PhA=
--- a/iam/converter.go
+++ b/iam/converter.go
@ -3,6 +3,7 @@ package iam
 import (
 	"errors"
 	"fmt"
+	"net/netip"
 	"strconv"
 	"strings"
 	"time"
@ -62,11 +63,15 @@ const (
 	s3ActionPutObjectTagging                 = "s3:PutObjectTagging"
 	s3ActionPutObjectVersionACL              = "s3:PutObjectVersionAcl"
 	s3ActionPutObjectVersionTagging          = "s3:PutObjectVersionTagging"
+	s3ActionPatchObject                      = "s3:PatchObject"
 )

 const (
 	condKeyAWSPrincipalARN       = "aws:PrincipalArn"
+	condKeyAWSSourceIP           = "aws:SourceIp"
 	condKeyAWSPrincipalTagPrefix = "aws:PrincipalTag/"
+	condKeyAWSRequestTagPrefix   = "aws:RequestTag/"
+	condKeyAWSResourceTagPrefix  = "aws:ResourceTag/"
 	userClaimTagPrefix           = "tag-"
 )

@ -180,7 +185,7 @@ func convertToChainCondition(c Conditions) ([]GroupedConditions, error) {

 				group.Conditions[i] = chain.Condition{
 					Op:    condType,
-					Object: chain.ObjectRequest,
+					Kind:  chain.KindRequest,
 					Key:   transformKey(key),
 					Value: converted,
 				}
@ -198,6 +203,11 @@ func transformKey(key string) string {
 		return fmt.Sprintf(common.PropertyKeyFormatFrostFSIDUserClaim, userClaimTagPrefix+tagName)
 	}

+	switch key {
+	case condKeyAWSSourceIP:
+		return common.PropertyKeyFrostFSSourceIP
+	}
+
 	return key
 }

@ -255,13 +265,9 @@ func getConditionTypeAndConverter(op string) (chain.ConditionType, convertFuncti
 	case op == CondBool:
 		return chain.CondStringEqualsIgnoreCase, noConvertFunction, nil
 	case op == CondIPAddress:
-		// todo consider using converters
-		//  "203.0.113.0/24" -> "203.0.113.*",
-		//  "2001:DB8:1234:5678::/64" -> "2001:DB8:1234:5678:*"
-		//  or having specific condition type for IP
-		return chain.CondStringLike, noConvertFunction, nil
+		return chain.CondIPAddress, ipConvertFunction, nil
 	case op == CondNotIPAddress:
-		return chain.CondStringNotLike, noConvertFunction, nil
+		return chain.CondNotIPAddress, ipConvertFunction, nil
 	case op == CondSliceContains:
 		return chain.CondSliceContains, noConvertFunction, nil
 	default:
@ -302,6 +308,17 @@ func numericConvertFunction(val string) (string, error) {
 	return "", fmt.Errorf("invalid numeric value: '%s'", val)
 }

+func ipConvertFunction(val string) (string, error) {
+	if _, err := netip.ParsePrefix(val); err != nil {
+		if _, err = netip.ParseAddr(val); err != nil {
+			return "", err
+		}
+		val += "/32"
+	}
+
+	return val, nil
+}
+
 func dateConvertFunction(val string) (string, error) {
 	if _, err := strconv.ParseInt(val, 10, 64); err == nil {
 		return val, nil
--- a/iam/converter_native.go
+++ b/iam/converter_native.go
@ -1,6 +1,7 @@
 package iam

 import (
+	"errors"
 	"fmt"
 	"strings"

@ -11,54 +12,55 @@ import (
 const PropertyKeyFilePath = "FilePath"

 var actionToNativeOpMap = map[string][]string{
-	s3ActionAbortMultipartUpload:             {native.MethodGetContainer, native.MethodDeleteObject, native.MethodHeadObject},
-	s3ActionCreateBucket:                     {native.MethodGetContainer, native.MethodPutContainer, native.MethodSetContainerEACL},
-	s3ActionDeleteBucket:                     {native.MethodGetContainer, native.MethodDeleteContainer, native.MethodSearchObject, native.MethodHeadObject},
+	s3ActionAbortMultipartUpload:             {native.MethodGetContainer, native.MethodDeleteObject, native.MethodHeadObject, native.MethodGetObject, native.MethodPutObject},
+	s3ActionCreateBucket:                     {native.MethodGetContainer, native.MethodPutContainer, native.MethodSetContainerEACL, native.MethodGetObject, native.MethodPutObject},
+	s3ActionDeleteBucket:                     {native.MethodGetContainer, native.MethodDeleteContainer, native.MethodSearchObject, native.MethodHeadObject, native.MethodGetObject},
 	s3ActionDeleteBucketPolicy:               {native.MethodGetContainer},
-	s3ActionDeleteObject:                     {native.MethodGetContainer, native.MethodDeleteObject, native.MethodPutObject, native.MethodHeadObject},
-	s3ActionDeleteObjectTagging:              {native.MethodGetContainer, native.MethodHeadObject},
-	s3ActionDeleteObjectVersion:              {native.MethodGetContainer, native.MethodDeleteObject, native.MethodPutObject, native.MethodHeadObject},
-	s3ActionDeleteObjectVersionTagging:       {native.MethodGetContainer, native.MethodHeadObject},
-	s3ActionGetBucketACL:                     {native.MethodGetContainer, native.MethodGetContainerEACL},
+	s3ActionDeleteObject:                     {native.MethodGetContainer, native.MethodDeleteObject, native.MethodPutObject, native.MethodHeadObject, native.MethodGetObject, native.MethodRangeObject},
+	s3ActionDeleteObjectTagging:              {native.MethodGetContainer, native.MethodHeadObject, native.MethodGetObject, native.MethodPutObject},
+	s3ActionDeleteObjectVersion:              {native.MethodGetContainer, native.MethodDeleteObject, native.MethodPutObject, native.MethodHeadObject, native.MethodGetObject, native.MethodRangeObject},
+	s3ActionDeleteObjectVersionTagging:       {native.MethodGetContainer, native.MethodHeadObject, native.MethodGetObject, native.MethodPutObject},
+	s3ActionGetBucketACL:                     {native.MethodGetContainer, native.MethodGetContainerEACL, native.MethodGetObject},
 	s3ActionGetBucketCORS:                    {native.MethodGetContainer, native.MethodGetObject, native.MethodHeadObject},
 	s3ActionGetBucketLocation:                {native.MethodGetContainer},
 	s3ActionGetBucketNotification:            {native.MethodGetContainer, native.MethodGetObject, native.MethodHeadObject},
-	s3ActionGetBucketObjectLockConfiguration: {native.MethodGetContainer},
+	s3ActionGetBucketObjectLockConfiguration: {native.MethodGetContainer, native.MethodGetObject},
 	s3ActionGetBucketPolicy:                  {native.MethodGetContainer},
 	s3ActionGetBucketPolicyStatus:            {native.MethodGetContainer},
-	s3ActionGetBucketTagging:                 {native.MethodGetContainer},
-	s3ActionGetBucketVersioning:              {native.MethodGetContainer},
-	s3ActionGetLifecycleConfiguration:        { /*not implemented yet*/ },
+	s3ActionGetBucketTagging:                 {native.MethodGetContainer, native.MethodGetObject},
+	s3ActionGetBucketVersioning:              {native.MethodGetContainer, native.MethodGetObject},
+	s3ActionGetLifecycleConfiguration:        {native.MethodGetContainer, native.MethodGetObject, native.MethodHeadObject},
 	s3ActionGetObject:                        {native.MethodGetContainer, native.MethodGetObject, native.MethodHeadObject, native.MethodSearchObject, native.MethodRangeObject, native.MethodHashObject},
 	s3ActionGetObjectACL:                     {native.MethodGetContainer, native.MethodGetContainerEACL, native.MethodGetObject, native.MethodHeadObject},
 	s3ActionGetObjectAttributes:              {native.MethodGetContainer, native.MethodGetObject, native.MethodHeadObject},
-	s3ActionGetObjectLegalHold:               {native.MethodGetContainer, native.MethodHeadObject},
-	s3ActionGetObjectRetention:               {native.MethodGetContainer, native.MethodHeadObject},
-	s3ActionGetObjectTagging:                 {native.MethodGetContainer, native.MethodHeadObject},
+	s3ActionGetObjectLegalHold:               {native.MethodGetContainer, native.MethodHeadObject, native.MethodGetObject},
+	s3ActionGetObjectRetention:               {native.MethodGetContainer, native.MethodHeadObject, native.MethodGetObject},
+	s3ActionGetObjectTagging:                 {native.MethodGetContainer, native.MethodHeadObject, native.MethodGetObject},
 	s3ActionGetObjectVersion:                 {native.MethodGetContainer, native.MethodGetObject, native.MethodHeadObject, native.MethodSearchObject, native.MethodRangeObject, native.MethodHashObject},
 	s3ActionGetObjectVersionACL:              {native.MethodGetContainer, native.MethodGetContainerEACL, native.MethodGetObject, native.MethodHeadObject},
 	s3ActionGetObjectVersionAttributes:       {native.MethodGetContainer, native.MethodGetObject, native.MethodHeadObject},
-	s3ActionGetObjectVersionTagging:          {native.MethodGetContainer, native.MethodHeadObject},
+	s3ActionGetObjectVersionTagging:          {native.MethodGetContainer, native.MethodHeadObject, native.MethodGetObject},
 	s3ActionListAllMyBuckets:                 {native.MethodListContainers, native.MethodGetContainer},
 	s3ActionListBucket:                       {native.MethodGetContainer, native.MethodGetObject, native.MethodHeadObject, native.MethodSearchObject, native.MethodRangeObject, native.MethodHashObject},
-	s3ActionListBucketMultipartUploads:       {native.MethodGetContainer},
+	s3ActionListBucketMultipartUploads:       {native.MethodGetContainer, native.MethodGetObject},
 	s3ActionListBucketVersions:               {native.MethodGetContainer, native.MethodGetObject, native.MethodHeadObject, native.MethodSearchObject, native.MethodRangeObject, native.MethodHashObject},
-	s3ActionListMultipartUploadParts:         {native.MethodGetContainer},
-	s3ActionPutBucketACL:                     {native.MethodGetContainer, native.MethodSetContainerEACL},
-	s3ActionPutBucketCORS:                    {native.MethodGetContainer},
-	s3ActionPutBucketNotification:            {native.MethodGetContainer, native.MethodHeadObject, native.MethodDeleteObject, native.MethodHeadObject},
-	s3ActionPutBucketObjectLockConfiguration: {native.MethodGetContainer},
+	s3ActionListMultipartUploadParts:         {native.MethodGetContainer, native.MethodGetObject},
+	s3ActionPutBucketACL:                     {native.MethodGetContainer, native.MethodSetContainerEACL, native.MethodGetObject, native.MethodPutObject},
+	s3ActionPutBucketCORS:                    {native.MethodGetContainer, native.MethodGetObject, native.MethodPutObject},
+	s3ActionPutBucketNotification:            {native.MethodGetContainer, native.MethodHeadObject, native.MethodDeleteObject, native.MethodGetObject, native.MethodPutObject},
+	s3ActionPutBucketObjectLockConfiguration: {native.MethodGetContainer, native.MethodGetObject, native.MethodPutObject},
 	s3ActionPutBucketPolicy:                  {native.MethodGetContainer},
-	s3ActionPutBucketTagging:                 {native.MethodGetContainer},
-	s3ActionPutBucketVersioning:              {native.MethodGetContainer},
-	s3ActionPutLifecycleConfiguration:        { /*not implemented yet*/ },
-	s3ActionPutObject:                        {native.MethodGetContainer, native.MethodPutObject},
+	s3ActionPutBucketTagging:                 {native.MethodGetContainer, native.MethodGetObject, native.MethodPutObject},
+	s3ActionPutBucketVersioning:              {native.MethodGetContainer, native.MethodGetObject, native.MethodPutObject},
+	s3ActionPutLifecycleConfiguration:        {native.MethodGetContainer, native.MethodGetObject, native.MethodHeadObject, native.MethodPutObject, native.MethodDeleteObject},
+	s3ActionPutObject:                        {native.MethodGetContainer, native.MethodPutObject, native.MethodGetObject, native.MethodHeadObject, native.MethodRangeObject},
 	s3ActionPutObjectACL:                     {native.MethodGetContainer, native.MethodGetContainerEACL, native.MethodSetContainerEACL, native.MethodGetObject, native.MethodHeadObject},
-	s3ActionPutObjectLegalHold:               {native.MethodGetContainer, native.MethodHeadObject},
-	s3ActionPutObjectRetention:               {native.MethodGetContainer, native.MethodHeadObject},
-	s3ActionPutObjectTagging:                 {native.MethodGetContainer, native.MethodHeadObject},
+	s3ActionPutObjectLegalHold:               {native.MethodGetContainer, native.MethodHeadObject, native.MethodGetObject, native.MethodPutObject},
+	s3ActionPutObjectRetention:               {native.MethodGetContainer, native.MethodHeadObject, native.MethodGetObject, native.MethodPutObject},
+	s3ActionPutObjectTagging:                 {native.MethodGetContainer, native.MethodHeadObject, native.MethodGetObject, native.MethodPutObject},
 	s3ActionPutObjectVersionACL:              {native.MethodGetContainer, native.MethodGetContainerEACL, native.MethodSetContainerEACL, native.MethodGetObject, native.MethodHeadObject},
-	s3ActionPutObjectVersionTagging:          {native.MethodGetContainer, native.MethodHeadObject},
+	s3ActionPutObjectVersionTagging:          {native.MethodGetContainer, native.MethodHeadObject, native.MethodGetObject, native.MethodPutObject},
+	s3ActionPatchObject:                      {native.MethodGetContainer, native.MethodGetObject, native.MethodHeadObject, native.MethodPatchObject, native.MethodPutObject, native.MethodRangeObject},
 }

 var containerNativeOperations = map[string]struct{}{
@ -80,6 +82,8 @@ var objectNativeOperations = map[string]struct{}{
 	native.MethodHashObject:   {},
 }

+var errConditionKeyNotApplicable = errors.New("condition key is not applicable")
+
 type NativeResolver interface {
 	GetUserKey(account, name string) (string, error)
 	GetBucketInfo(bucket string) (*BucketInfo, error)
@ -123,6 +127,9 @@ func ConvertToNativeChain(p Policy, resolver NativeResolver) (*chain.Chain, erro

 		groupedConditions, err := convertToNativeChainCondition(statement.Conditions, resolver)
 		if err != nil {
+			if errors.Is(err, errConditionKeyNotApplicable) {
+				continue
+			}
 			return nil, err
 		}
 		splitConditions := splitGroupedConditions(groupedConditions)
@ -209,7 +216,7 @@ func getNativePrincipalsAndConditionFunc(statement Statement, resolver NativeRes
 	return principals, func(principal string) chain.Condition {
 		return chain.Condition{
 			Op:    op,
-			Object: chain.ObjectRequest,
+			Kind:  chain.KindRequest,
 			Key:   native.PropertyKeyActorPublicKey,
 			Value: principal,
 		}
@ -218,18 +225,33 @@ func getNativePrincipalsAndConditionFunc(statement Statement, resolver NativeRes

 func convertToNativeChainCondition(c Conditions, resolver NativeResolver) ([]GroupedConditions, error) {
 	return convertToChainConditions(c, func(gr GroupedConditions) (GroupedConditions, error) {
+		res := GroupedConditions{
+			Conditions: make([]chain.Condition, 0, len(gr.Conditions)),
+			Any:        gr.Any,
+		}
+
 		for i := range gr.Conditions {
-			if gr.Conditions[i].Key == condKeyAWSPrincipalARN {
+			switch {
+			case gr.Conditions[i].Key == condKeyAWSMFAPresent:
+				return GroupedConditions{}, errConditionKeyNotApplicable
+			case gr.Conditions[i].Key == condKeyAWSPrincipalARN:
 				gr.Conditions[i].Key = native.PropertyKeyActorPublicKey
 				val, err := formPrincipalKey(gr.Conditions[i].Value, resolver)
 				if err != nil {
 					return GroupedConditions{}, err
 				}
 				gr.Conditions[i].Value = val
+				res.Conditions = append(res.Conditions, gr.Conditions[i])
+			case strings.HasPrefix(gr.Conditions[i].Key, condKeyAWSRequestTagPrefix) ||
+				strings.HasPrefix(gr.Conditions[i].Key, condKeyAWSResourceTagPrefix):
+				// Tags exist only in S3 requests, so native protocol should not process such conditions.
+				continue
+			default:
+				res.Conditions = append(res.Conditions, gr.Conditions[i])
 			}
 		}

-		return gr, nil
+		return res, nil
 	})
 }

@ -306,7 +328,7 @@ func formNativeResourceNamesAndConditions(names []string, resolver NativeResolve
 			Conditions: []chain.Condition{
 				{
 					Op:    chain.CondStringLike,
-					Object: chain.ObjectResource,
+					Kind:  chain.KindResource,
 					Key:   PropertyKeyFilePath,
 					Value: obj,
 				},
--- a/iam/converter_s3.go
+++ b/iam/converter_s3.go
@ -2,11 +2,14 @@ package iam

 import (
 	"fmt"
+	"strings"

 	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
 	"git.frostfs.info/TrueCloudLab/policy-engine/schema/s3"
 )

+const condKeyAWSMFAPresent = "aws:MultiFactorAuthPresent"
+
 var actionToS3OpMap = map[string][]string{
 	s3ActionAbortMultipartUpload:  {s3ActionAbortMultipartUpload},
 	s3ActionCreateBucket:          {s3ActionCreateBucket},
@ -29,6 +32,7 @@ var actionToS3OpMap = map[string][]string{
 	s3ActionPutObjectLegalHold:    {s3ActionPutObjectLegalHold},
 	s3ActionPutObjectRetention:    {s3ActionPutObjectRetention},
 	s3ActionPutObjectTagging:      {s3ActionPutObjectTagging},
+	s3ActionPatchObject:           {s3ActionPatchObject},

 	s3ActionListAllMyBuckets:                 {"s3:ListBuckets"},
 	s3ActionListBucket:                       {"s3:HeadBucket", "s3:GetBucketLocation", "s3:ListObjectsV1", "s3:ListObjectsV2"},
@ -157,7 +161,7 @@ func getS3PrincipalsAndConditionFunc(statement Statement, resolver S3Resolver) (
 	return principals, func(principal string) chain.Condition {
 		return chain.Condition{
 			Op:    op,
-			Object: chain.ObjectRequest,
+			Kind:  chain.KindRequest,
 			Key:   s3.PropertyKeyOwner,
 			Value: principal,
 		}
@ -167,13 +171,19 @@ func getS3PrincipalsAndConditionFunc(statement Statement, resolver S3Resolver) (
 func convertToS3ChainCondition(c Conditions, resolver S3Resolver) ([]GroupedConditions, error) {
 	return convertToChainConditions(c, func(gr GroupedConditions) (GroupedConditions, error) {
 		for i := range gr.Conditions {
-			if gr.Conditions[i].Key == condKeyAWSPrincipalARN {
+			switch {
+			case gr.Conditions[i].Key == condKeyAWSPrincipalARN:
 				gr.Conditions[i].Key = s3.PropertyKeyOwner
 				val, err := formPrincipalOwner(gr.Conditions[i].Value, resolver)
 				if err != nil {
 					return GroupedConditions{}, err
 				}
 				gr.Conditions[i].Value = val
+
+			case gr.Conditions[i].Key == condKeyAWSMFAPresent:
+				gr.Conditions[i].Key = s3.PropertyKeyAccessBoxAttrMFA
+			case strings.HasPrefix(gr.Conditions[i].Key, condKeyAWSResourceTagPrefix):
+				gr.Conditions[i].Kind = chain.KindResource
 			}
 		}

--- a/iam/converter_test.go
+++ b/iam/converter_test.go
@ -103,13 +103,13 @@ func TestConverters(t *testing.T) {
 				Condition: []chain.Condition{
 					{
 						Op:    chain.CondStringEquals,
-						Object: chain.ObjectRequest,
+						Kind:  chain.KindRequest,
 						Key:   s3.PropertyKeyOwner,
 						Value: mockResolver.users[user],
 					},
 					{
 						Op:    chain.CondStringEquals,
-						Object: chain.ObjectRequest,
+						Kind:  chain.KindRequest,
 						Key:   "s3:RequestObjectTag/Department",
 						Value: "Finance",
 					},
@ -138,7 +138,8 @@ func TestConverters(t *testing.T) {
 		expected := &chain.Chain{Rules: []chain.Rule{
 			{
 				Status: chain.Allow,
-				Actions: chain.Actions{Names: []string{native.MethodGetContainer, native.MethodPutObject}},
+				Actions: chain.Actions{Names: []string{native.MethodGetContainer, native.MethodPutObject,
+					native.MethodGetObject, native.MethodHeadObject, native.MethodRangeObject}},
 				Resources: chain.Resources{Names: []string{
 					fmt.Sprintf(native.ResourceFormatNamespaceContainerObjects, namespace, mockResolver.containers[bktName]),
 					fmt.Sprintf(native.ResourceFormatNamespaceContainer, namespace, mockResolver.containers[bktName])},
@ -146,7 +147,7 @@ func TestConverters(t *testing.T) {
 				Condition: []chain.Condition{
 					{
 						Op:    chain.CondStringEquals,
-						Object: chain.ObjectRequest,
+						Kind:  chain.KindRequest,
 						Key:   native.PropertyKeyActorPublicKey,
 						Value: mockResolver.users[user],
 					},
@ -180,7 +181,7 @@ func TestConverters(t *testing.T) {
 				Condition: []chain.Condition{
 					{
 						Op:    chain.CondStringNotEquals,
-						Object: chain.ObjectRequest,
+						Kind:  chain.KindRequest,
 						Key:   s3.PropertyKeyOwner,
 						Value: mockResolver.users[user],
 					},
@ -212,7 +213,12 @@ func TestConverters(t *testing.T) {
 		expected := &chain.Chain{Rules: []chain.Rule{
 			{
 				Status: chain.Allow,
-				Actions: chain.Actions{Names: []string{native.MethodGetContainer, native.MethodDeleteContainer, native.MethodSearchObject, native.MethodHeadObject, native.MethodDeleteObject, native.MethodPutObject}},
+				Actions: chain.Actions{Names: []string{
+					native.MethodGetContainer, native.MethodDeleteContainer,
+					native.MethodSearchObject, native.MethodHeadObject,
+					native.MethodDeleteObject, native.MethodPutObject,
+					native.MethodGetObject, native.MethodRangeObject,
+				}},
 				Resources: chain.Resources{Names: []string{
 					fmt.Sprintf(native.ResourceFormatNamespaceContainerObjects, namespace, mockResolver.containers[bktName]),
 					fmt.Sprintf(native.ResourceFormatNamespaceContainer, namespace, mockResolver.containers[bktName]),
@ -220,13 +226,13 @@ func TestConverters(t *testing.T) {
 				Condition: []chain.Condition{
 					{
 						Op:    chain.CondStringEquals,
-						Object: chain.ObjectRequest,
+						Kind:  chain.KindRequest,
 						Key:   native.PropertyKeyActorPublicKey,
 						Value: mockResolver.users[user],
 					},
 					{
 						Op:    chain.CondStringLike,
-						Object: chain.ObjectResource,
+						Kind:  chain.KindResource,
 						Key:   PropertyKeyFilePath,
 						Value: objName,
 					},
@ -234,13 +240,18 @@ func TestConverters(t *testing.T) {
 			},
 			{
 				Status: chain.Allow,
-				Actions: chain.Actions{Names: []string{native.MethodGetContainer, native.MethodDeleteContainer, native.MethodSearchObject, native.MethodHeadObject, native.MethodDeleteObject, native.MethodPutObject}},
+				Actions: chain.Actions{Names: []string{
+					native.MethodGetContainer, native.MethodDeleteContainer,
+					native.MethodSearchObject, native.MethodHeadObject,
+					native.MethodDeleteObject, native.MethodPutObject,
+					native.MethodGetObject, native.MethodRangeObject,
+				}},
 				Resources: chain.Resources{Names: []string{
 					fmt.Sprintf(native.ResourceFormatNamespaceContainer, namespace, mockResolver.containers[bktName]),
 				}},
 				Condition: []chain.Condition{{
 					Op:    chain.CondStringEquals,
-					Object: chain.ObjectRequest,
+					Kind:  chain.KindRequest,
 					Key:   native.PropertyKeyActorPublicKey,
 					Value: mockResolver.users[user],
 				}},
@ -335,7 +346,7 @@ func TestConverters(t *testing.T) {
 			Resources: chain.Resources{Names: []string{"*"}},
 			Condition: []chain.Condition{{
 				Op:    chain.CondStringEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   s3.PropertyKeyOwner,
 				Value: mockResolver.users[user],
 			}},
@ -347,11 +358,11 @@ func TestConverters(t *testing.T) {

 		nativeExpected := &chain.Chain{Rules: []chain.Rule{{
 			Status:    chain.Allow,
-			Actions:   chain.Actions{Names: []string{native.MethodGetContainer, native.MethodDeleteObject, native.MethodPutObject, native.MethodHeadObject}},
+			Actions:   chain.Actions{Names: []string{native.MethodGetContainer, native.MethodDeleteObject, native.MethodPutObject, native.MethodHeadObject, native.MethodGetObject, native.MethodRangeObject}},
 			Resources: chain.Resources{Names: []string{native.ResourceFormatAllObjects, native.ResourceFormatAllContainers}},
 			Condition: []chain.Condition{{
 				Op:    chain.CondStringEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   native.PropertyKeyActorPublicKey,
 				Value: mockResolver.users[user],
 			}},
@ -380,8 +391,6 @@ func TestConvertToChainCondition(t *testing.T) {
 		CondDateGreaterThan:           {"key11": {"2006-01-02T15:04:05-01:00"}},
 		CondDateGreaterThanEquals:     {"key12": {"2006-01-02T15:04:05-03:00"}},
 		CondBool:                      {"key13": {"True"}},
-		CondIPAddress:                 {"key14": {"val14"}},
-		CondNotIPAddress:              {"key15": {"val15"}},
 		CondArnEquals:                 {"key16": {"val16"}},
 		CondArnLike:                   {condKeyAWSPrincipalARN: {principal}},
 		CondArnNotEquals:              {"key18": {"val18"}},
@ -400,13 +409,13 @@ func TestConvertToChainCondition(t *testing.T) {
 			Conditions: []chain.Condition{
 				{
 					Op:    chain.CondStringEquals,
-					Object: chain.ObjectRequest,
+					Kind:  chain.KindRequest,
 					Key:   "key1",
 					Value: "val0",
 				},
 				{
 					Op:    chain.CondStringEquals,
-					Object: chain.ObjectRequest,
+					Kind:  chain.KindRequest,
 					Key:   "key1",
 					Value: "val1",
 				},
@ -415,7 +424,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringNotEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key2",
 				Value: "val2",
 			}},
@ -423,7 +432,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringEqualsIgnoreCase,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key3",
 				Value: "val3",
 			}},
@ -431,7 +440,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringNotEqualsIgnoreCase,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key4",
 				Value: "val4",
 			}},
@ -439,7 +448,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringLike,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key5",
 				Value: "val5",
 			}},
@ -447,7 +456,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringNotLike,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key6",
 				Value: "val6",
 			}},
@ -455,7 +464,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key7",
 				Value: "1136189045",
 			}},
@ -463,7 +472,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringNotEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key8",
 				Value: "1136214245",
 			}},
@ -471,7 +480,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringLessThan,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key9",
 				Value: "1136192645",
 			}},
@ -479,7 +488,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringLessThanEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key10",
 				Value: "1136203445",
 			}},
@ -487,7 +496,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringGreaterThan,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key11",
 				Value: "1136217845",
 			}},
@ -495,7 +504,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringGreaterThanEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key12",
 				Value: "1136225045",
 			}},
@ -503,31 +512,15 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringEqualsIgnoreCase,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key13",
 				Value: "True",
 			}},
 		},
-		{
-			Conditions: []chain.Condition{{
-				Op:     chain.CondStringLike,
-				Object: chain.ObjectRequest,
-				Key:    "key14",
-				Value:  "val14",
-			}},
-		},
-		{
-			Conditions: []chain.Condition{{
-				Op:     chain.CondStringNotLike,
-				Object: chain.ObjectRequest,
-				Key:    "key15",
-				Value:  "val15",
-			}},
-		},
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key16",
 				Value: "val16",
 			}},
@ -535,7 +528,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringLike,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   condKeyAWSPrincipalARN,
 				Value: principal,
 			}},
@ -543,7 +536,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringNotEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key18",
 				Value: "val18",
 			}},
@ -551,7 +544,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondStringNotLike,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key19",
 				Value: "val19",
 			}},
@ -559,7 +552,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondNumericEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key20",
 				Value: "-20",
 			}},
@ -567,7 +560,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondNumericNotEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key21",
 				Value: "+21",
 			}},
@ -575,7 +568,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondNumericLessThan,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key22",
 				Value: "0",
 			}},
@ -583,7 +576,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondNumericLessThanEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key23",
 				Value: "23.23",
 			}},
@ -591,7 +584,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondNumericGreaterThan,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key24",
 				Value: "-24.24",
 			}},
@ -599,7 +592,7 @@ func TestConvertToChainCondition(t *testing.T) {
 		{
 			Conditions: []chain.Condition{{
 				Op:    chain.CondNumericGreaterThanEquals,
-				Object: chain.ObjectRequest,
+				Kind:  chain.KindRequest,
 				Key:   "key25",
 				Value: "+25.25",
 			}},
@ -628,6 +621,114 @@ func TestConvertToChainCondition(t *testing.T) {
 	}
 }

+func TestIPConditions(t *testing.T) {
+	t.Run("ip converters", func(t *testing.T) {
+		for _, tc := range []struct {
+			ip       string
+			error    bool
+			expected string
+		}{
+			{ip: "203.0.113.0/24", expected: "203.0.113.0/24"},
+			{ip: "203.0.113.1", expected: "203.0.113.1/32"},
+			{ip: "203.0.113.1/", error: true},
+			{ip: "203.0.113.1/33", error: true},
+			{ip: "192.168.0.1/24", expected: "192.168.0.1/24"},
+			{ip: "10.10.0.1/24", expected: "10.10.0.1/24"},
+			{ip: "172.16.0.1/24", expected: "172.16.0.1/24"},
+			{ip: "2001:DB8:1234:5678::/64", expected: "2001:DB8:1234:5678::/64"},
+			{ip: "2001:DB8:1234:5678::", expected: "2001:DB8:1234:5678::/32"},
+			{ip: "2001:DB8:1234:5678::/", error: true},
+			{ip: "2001:DB8:1234:5678::/129", error: true},
+			{ip: "FC00::/64", expected: "FC00::/64"},
+		} {
+			t.Run("", func(t *testing.T) {
+				actual, err := ipConvertFunction(tc.ip)
+				if tc.error {
+					require.Error(t, err)
+					return
+				}
+				require.NoError(t, err)
+				require.Equal(t, tc.expected, actual)
+			})
+		}
+	})
+
+	t.Run("chain converters", func(t *testing.T) {
+		policy := `{"Version":"2012-10-17",
+"Statement":{"Effect":"Allow","Principal": "*","Action":"s3:*","Resource":"*","Condition": {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}}
+}`
+
+		var p Policy
+		err := json.Unmarshal([]byte(policy), &p)
+		require.NoError(t, err)
+
+		s3Expected := &chain.Chain{
+			Rules: []chain.Rule{{
+				Status:    chain.Allow,
+				Actions:   chain.Actions{Names: []string{"s3:*"}},
+				Resources: chain.Resources{Names: []string{Wildcard}},
+				Condition: []chain.Condition{{
+					Op:    chain.CondIPAddress,
+					Kind:  chain.KindRequest,
+					Key:   common.PropertyKeyFrostFSSourceIP,
+					Value: "203.0.113.0/24",
+				}},
+			}},
+		}
+
+		s3Chain, err := ConvertToS3Chain(p, newMockUserResolver(nil, nil, ""))
+		require.NoError(t, err)
+		require.Equal(t, s3Expected, s3Chain)
+
+		nativeExpected := &chain.Chain{
+			Rules: []chain.Rule{{
+				Status:    chain.Allow,
+				Actions:   chain.Actions{Names: []string{Wildcard}},
+				Resources: chain.Resources{Names: []string{native.ResourceFormatAllObjects, native.ResourceFormatAllContainers}},
+				Condition: []chain.Condition{{
+					Op:    chain.CondIPAddress,
+					Kind:  chain.KindRequest,
+					Key:   common.PropertyKeyFrostFSSourceIP,
+					Value: "203.0.113.0/24",
+				}},
+			}},
+		}
+
+		nativeChain, err := ConvertToNativeChain(p, newMockUserResolver(nil, nil, ""))
+		require.NoError(t, err)
+		require.Equal(t, nativeExpected, nativeChain)
+	})
+
+	t.Run("matching rules", func(t *testing.T) {
+		policy := `{"Version":"2012-10-17",
+"Statement":{"Effect":"Allow","Principal": "*","Action":"s3:*","Resource":"*","Condition": {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}}
+}`
+
+		var p Policy
+		err := json.Unmarshal([]byte(policy), &p)
+		require.NoError(t, err)
+
+		s3Chain, err := ConvertToS3Chain(p, newMockUserResolver(nil, nil, ""))
+		require.NoError(t, err)
+
+		s := inmemory.NewInMemory()
+		_, _, err = s.MorphRuleChainStorage().AddMorphRuleChain(chain.S3, engine.NamespaceTarget(""), s3Chain)
+		require.NoError(t, err)
+
+		req := testutil.NewRequest("s3:CreateBucket", testutil.NewResource(fmt.Sprintf(s3.ResourceFormatS3Bucket, "bkt"), nil),
+			map[string]string{common.PropertyKeyFrostFSSourceIP: "203.0.113.128"})
+		status, _, err := s.IsAllowed(chain.S3, engine.NewRequestTargetWithNamespace(""), req)
+		require.NoError(t, err)
+		require.Equal(t, chain.Allow.String(), status.String())
+
+		req = testutil.NewRequest("s3:CreateBucket", testutil.NewResource(fmt.Sprintf(s3.ResourceFormatS3Bucket, "bkt"), nil),
+			map[string]string{common.PropertyKeyFrostFSSourceIP: "203.0.114.0"})
+		status, _, err = s.IsAllowed(chain.S3, engine.NewRequestTargetWithNamespace(""), req)
+		require.NoError(t, err)
+		require.Equal(t, chain.NoRuleFound.String(), status.String())
+	})
+}
+
 func TestParsePrincipalARN(t *testing.T) {
 	for i, tc := range []struct {
 		principal string
@ -727,12 +828,12 @@ func TestComplexNativeConditions(t *testing.T) {
 	expectedResource1 := chain.Resources{Names: []string{nativeResource1, nativeResource1cnr}}
 	expectedResource23 := chain.Resources{Names: []string{nativeResource2, nativeResource2cnr, nativeResource3, nativeResource3cnr}}

-	user1Condition := chain.Condition{Op: chain.CondStringEquals, Object: chain.ObjectRequest, Key: native.PropertyKeyActorPublicKey, Value: mockResolver.users[user1]}
-	user2Condition := chain.Condition{Op: chain.CondStringEquals, Object: chain.ObjectRequest, Key: native.PropertyKeyActorPublicKey, Value: mockResolver.users[user2]}
-	objectName1Condition := chain.Condition{Op: chain.CondStringLike, Object: chain.ObjectResource, Key: PropertyKeyFilePath, Value: objName1}
-	key1val0Condition := chain.Condition{Op: chain.CondStringEquals, Object: chain.ObjectRequest, Key: key1, Value: val0}
-	key1val1Condition := chain.Condition{Op: chain.CondStringEquals, Object: chain.ObjectRequest, Key: key1, Value: val1}
-	key2val2Condition := chain.Condition{Op: chain.CondStringLike, Object: chain.ObjectRequest, Key: key2, Value: val2}
+	user1Condition := chain.Condition{Op: chain.CondStringEquals, Kind: chain.KindRequest, Key: native.PropertyKeyActorPublicKey, Value: mockResolver.users[user1]}
+	user2Condition := chain.Condition{Op: chain.CondStringEquals, Kind: chain.KindRequest, Key: native.PropertyKeyActorPublicKey, Value: mockResolver.users[user2]}
+	objectName1Condition := chain.Condition{Op: chain.CondStringLike, Kind: chain.KindResource, Key: PropertyKeyFilePath, Value: objName1}
+	key1val0Condition := chain.Condition{Op: chain.CondStringEquals, Kind: chain.KindRequest, Key: key1, Value: val0}
+	key1val1Condition := chain.Condition{Op: chain.CondStringEquals, Kind: chain.KindRequest, Key: key1, Value: val1}
+	key2val2Condition := chain.Condition{Op: chain.CondStringLike, Kind: chain.KindRequest, Key: key2, Value: val2}

 	expected := &chain.Chain{Rules: []chain.Rule{
 		{
@ -1037,11 +1138,11 @@ func TestComplexS3Conditions(t *testing.T) {
 	expectedActions := chain.Actions{Names: []string{action, action2}}
 	expectedResources := chain.Resources{Names: []string{resource1, resource2, resource3}}

-	user1Condition := chain.Condition{Op: chain.CondStringEquals, Object: chain.ObjectRequest, Key: s3.PropertyKeyOwner, Value: mockResolver.users[user1]}
-	user2Condition := chain.Condition{Op: chain.CondStringEquals, Object: chain.ObjectRequest, Key: s3.PropertyKeyOwner, Value: mockResolver.users[user2]}
-	key1val0Condition := chain.Condition{Op: chain.CondStringEquals, Object: chain.ObjectRequest, Key: key1, Value: val0}
-	key1val1Condition := chain.Condition{Op: chain.CondStringEquals, Object: chain.ObjectRequest, Key: key1, Value: val1}
-	key2val2Condition := chain.Condition{Op: chain.CondStringLike, Object: chain.ObjectRequest, Key: key2, Value: val2}
+	user1Condition := chain.Condition{Op: chain.CondStringEquals, Kind: chain.KindRequest, Key: s3.PropertyKeyOwner, Value: mockResolver.users[user1]}
+	user2Condition := chain.Condition{Op: chain.CondStringEquals, Kind: chain.KindRequest, Key: s3.PropertyKeyOwner, Value: mockResolver.users[user2]}
+	key1val0Condition := chain.Condition{Op: chain.CondStringEquals, Kind: chain.KindRequest, Key: key1, Value: val0}
+	key1val1Condition := chain.Condition{Op: chain.CondStringEquals, Kind: chain.KindRequest, Key: key1, Value: val1}
+	key2val2Condition := chain.Condition{Op: chain.CondStringLike, Kind: chain.KindRequest, Key: key2, Value: val2}

 	expected := &chain.Chain{Rules: []chain.Rule{
 		{
@ -1449,7 +1550,8 @@ func TestFromActions(t *testing.T) {
 			},
 			{
 				action: "s3:PutObject",
-				res:    []string{native.MethodGetContainer, native.MethodPutObject},
+				res: []string{native.MethodGetContainer, native.MethodPutObject,
+					native.MethodGetObject, native.MethodHeadObject, native.MethodRangeObject},
 			},
 			{
 				action: "s3:Put*",
@ -1594,27 +1696,80 @@ func TestTagsConditions(t *testing.T) {
 }
 `

-	expectedConditions := []chain.Condition{
+	expectedS3Conditions := []chain.Condition{
 		{
 			Op:    chain.CondStringEquals,
-			Object: chain.ObjectRequest,
+			Kind:  chain.KindRequest,
 			Key:   fmt.Sprintf(common.PropertyKeyFormatFrostFSIDUserClaim, "tag-department"),
 			Value: "hr",
 		},
 		{
 			Op:    chain.CondStringEquals,
-			Object: chain.ObjectRequest,
+			Kind:  chain.KindResource,
 			Key:   fmt.Sprintf(s3.PropertyKeyFormatResourceTag, "owner"),
 			Value: "hr-admin",
 		},
 		{
 			Op:    chain.CondStringEquals,
-			Object: chain.ObjectRequest,
+			Kind:  chain.KindRequest,
 			Key:   fmt.Sprintf(s3.PropertyKeyFormatRequestTag, "scope"),
 			Value: "*",
 		},
 	}

+	expectedNativeConditions := []chain.Condition{
+		{
+			Op:    chain.CondStringEquals,
+			Kind:  chain.KindRequest,
+			Key:   fmt.Sprintf(common.PropertyKeyFormatFrostFSIDUserClaim, "tag-department"),
+			Value: "hr",
+		},
+	}
+
+	var p Policy
+	err := json.Unmarshal([]byte(policy), &p)
+	require.NoError(t, err)
+
+	s3Chain, err := ConvertToS3Chain(p, newMockUserResolver(nil, nil, ""))
+	require.NoError(t, err)
+	require.Len(t, s3Chain.Rules, 1)
+	require.ElementsMatch(t, expectedS3Conditions, s3Chain.Rules[0].Condition)
+
+	nativeChain, err := ConvertToNativeChain(p, newMockUserResolver(nil, nil, ""))
+	require.NoError(t, err)
+	require.Len(t, nativeChain.Rules, 1)
+	require.ElementsMatch(t, expectedNativeConditions, nativeChain.Rules[0].Condition)
+}
+
+func TestMFACondition(t *testing.T) {
+	policy := `
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+	  "Principal": "*",
+      "Action": "s3:PutObject",
+      "Resource": "*",
+      "Condition": {
+        "Bool": {
+          "aws:MultiFactorAuthPresent": "true"
+        }
+      }
+    }
+  ]
+}
+`
+
+	expectedConditions := []chain.Condition{
+		{
+			Op:    chain.CondStringEqualsIgnoreCase,
+			Kind:  chain.KindRequest,
+			Key:   s3.PropertyKeyAccessBoxAttrMFA,
+			Value: "true",
+		},
+	}
+
 	var p Policy
 	err := json.Unmarshal([]byte(policy), &p)
 	require.NoError(t, err)
@ -1624,10 +1779,40 @@ func TestTagsConditions(t *testing.T) {
 	require.Len(t, s3Chain.Rules, 1)
 	require.ElementsMatch(t, expectedConditions, s3Chain.Rules[0].Condition)

-	nativeChain, err := ConvertToNativeChain(p, newMockUserResolver(nil, nil, ""))
+	_, err = ConvertToNativeChain(p, newMockUserResolver(nil, nil, ""))
+	require.ErrorIs(t, err, ErrActionsNotApplicable)
+
+	policy = `
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+	  "Principal": "*",
+      "Action": "s3:GetObject",
+      "Resource": "*",
+      "Condition": {
+        "Bool": {
+          "aws:MultiFactorAuthPresent": "false"
+        }
+      }
+    }
+  ]
+}
+`
+
+	expectedConditions[0].Value = "false"
+
+	err = json.Unmarshal([]byte(policy), &p)
 	require.NoError(t, err)
-	require.Len(t, nativeChain.Rules, 1)
-	require.ElementsMatch(t, expectedConditions, nativeChain.Rules[0].Condition)
+
+	s3Chain, err = ConvertToS3Chain(p, newMockUserResolver(nil, nil, ""))
+	require.NoError(t, err)
+	require.Len(t, s3Chain.Rules, 1)
+	require.ElementsMatch(t, expectedConditions, s3Chain.Rules[0].Condition)
+
+	_, err = ConvertToNativeChain(p, newMockUserResolver(nil, nil, ""))
+	require.ErrorIs(t, err, ErrActionsNotApplicable)
 }

 func requireChainRulesMatch(t *testing.T, expected, actual []chain.Rule) {
--- a/pkg/chain/chain.go
+++ b/pkg/chain/chain.go
@ -2,6 +2,7 @@ package chain

 import (
 	"fmt"
+	"net/netip"
 	"strings"

 	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/resource"
@ -68,18 +69,16 @@ type Resources struct {

 type Condition struct {
 	Op    ConditionType
-	Object ObjectType
+	Kind  ConditionKindType
 	Key   string
 	Value string
 }

-type ObjectType byte
+type ConditionKindType byte

 const (
-	ObjectResource ObjectType = iota
-	ObjectRequest
-	ContainerResource
-	ContainerRequest
+	KindResource ConditionKindType = iota
+	KindRequest
 )

 type ConditionType byte
@ -109,6 +108,9 @@ const (
 	CondNumericGreaterThanEquals

 	CondSliceContains
+
+	CondIPAddress
+	CondNotIPAddress
 )

 var condToStr = []struct {
@ -132,6 +134,8 @@ var condToStr = []struct {
 	{CondNumericGreaterThan, "NumericGreaterThan"},
 	{CondNumericGreaterThanEquals, "NumericGreaterThanEquals"},
 	{CondSliceContains, "SliceContains"},
+	{CondIPAddress, "IPAddress"},
+	{CondNotIPAddress, "NotIPAddress"},
 }

 func (c ConditionType) String() string {
@ -153,13 +157,13 @@ func FormCondSliceContainsValue(values []string) string {

 func (c *Condition) Match(req resource.Request) bool {
 	var val string
-	switch c.Object {
-	case ObjectResource:
+	switch c.Kind {
+	case KindResource:
 		val = req.Resource().Property(c.Key)
-	case ObjectRequest:
+	case KindRequest:
 		val = req.Property(c.Key)
 	default:
-		panic(fmt.Sprintf("unknown condition type: %d", c.Object))
+		panic(fmt.Sprintf("unknown condition type: %d", c.Kind))
 	}

 	switch c.Op {
@ -190,6 +194,8 @@ func (c *Condition) Match(req resource.Request) bool {
 	case CondNumericEquals, CondNumericNotEquals, CondNumericLessThan, CondNumericLessThanEquals, CondNumericGreaterThan,
 		CondNumericGreaterThanEquals:
 		return c.matchNumeric(val)
+	case CondIPAddress, CondNotIPAddress:
+		return c.matchIP(val)
 	}
 }

@ -222,6 +228,27 @@ func (c *Condition) matchNumeric(val string) bool {
 	}
 }

+func (c *Condition) matchIP(val string) bool {
+	ipAddr, err := netip.ParseAddr(val)
+	if err != nil {
+		return false
+	}
+
+	prefix, err := netip.ParsePrefix(c.Value)
+	if err != nil {
+		return false
+	}
+
+	switch c.Op {
+	default:
+		panic(fmt.Sprintf("unimplemented: %d", c.Op))
+	case CondIPAddress:
+		return prefix.Contains(ipAddr)
+	case CondNotIPAddress:
+		return !prefix.Contains(ipAddr)
+	}
+}
+
 func (r *Rule) Match(req resource.Request) (status Status, matched bool) {
 	found := len(r.Resources.Names) == 0
 	for i := range r.Resources.Names {
--- a/pkg/chain/chain_easyjson.go
+++ b/pkg/chain/chain_easyjson.go
--- a/pkg/chain/chain_test.go
+++ b/pkg/chain/chain_test.go
@ -1,6 +1,8 @@
 package chain

 import (
+	"fmt"
+	"strings"
 	"testing"

 	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/resource/testutil"
@ -50,7 +52,7 @@ func TestEncodeDecode(t *testing.T) {
 	require.Equal(t, expected, actual)
 }

-func TestReturnFirstMatch(t *testing.T) {
+func TestChainMatch(t *testing.T) {
 	ch := Chain{
 		Rules: []Rule{
 			{
@ -87,9 +89,195 @@ func TestReturnFirstMatch(t *testing.T) {
 		require.True(t, found)
 		require.Equal(t, Allow, st)
 	})
+
+	t.Run("unknown match", func(t *testing.T) {
+		ch.MatchType = MatchType(255)
+		request := testutil.NewRequest(native.MethodGetObject, resource, nil)
+		require.PanicsWithValue(t, "unknown MatchType 255", func() {
+			ch.Match(request)
+		})
+	})
+
+	t.Run("no rule found", func(t *testing.T) {
+		ch.MatchType = MatchTypeFirstMatch
+		request := testutil.NewRequest(native.MethodGetObject, resource, nil)
+		st, found := ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
 }

-func TestCondSliceContainsMatch(t *testing.T) {
+func TestAnyAllConditionMatch(t *testing.T) {
+	ch := Chain{
+		Rules: []Rule{
+			{
+				Status:    Allow,
+				Actions:   Actions{Names: []string{native.MethodPutObject}},
+				Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+				Condition: []Condition{
+					{
+						Op:    CondIPAddress,
+						Kind:  KindRequest,
+						Key:   common.PropertyKeyFrostFSSourceIP,
+						Value: "192.92.1.1/20",
+					},
+					{
+						Op:    CondStringEquals,
+						Kind:  KindRequest,
+						Key:   native.PropertyKeyActorRole,
+						Value: "owner",
+					},
+					{
+						Op:    CondStringEquals,
+						Kind:  KindResource,
+						Key:   native.PropertyKeyObjectID,
+						Value: "79xGoKYwhyJQhrDNb7bHhY1WCvN6trHJPTjKkw24c6W9",
+					},
+				},
+			},
+		}}
+
+	t.Run("match by all conditions", func(t *testing.T) {
+		ch.Rules[0].Any = false
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, map[string]string{
+			native.PropertyKeyObjectID: "79xGoKYwhyJQhrDNb7bHhY1WCvN6trHJPTjKkw24c6W9",
+		})
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.92.1.91",
+			native.PropertyKeyActorRole:       "owner",
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.93.1.91",
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run("match by any condition", func(t *testing.T) {
+		ch.Rules[0].Any = true
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, map[string]string{
+			native.PropertyKeyObjectID: "79xGoKYwhyJQhrDNb7bHhY1WCvN6trHJPTjKkw24c6W9",
+		})
+		request := testutil.NewRequest(native.MethodPutObject, resource, nil)
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			native.PropertyKeyActorRole: "owner",
+		})
+
+		st, found = ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		resource = testutil.NewResource(native.ResourceFormatRootContainers, map[string]string{})
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.92.1.91",
+		})
+
+		st, found = ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.93.1.91",
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+}
+
+func TestConditionMatch(t *testing.T) {
+	t.Run("condition types", func(t *testing.T) {
+		t.Run("slice condition type", testCondSliceContainsMatch)
+		t.Run("numeric condition types", testNumericConditionsMatch)
+		t.Run("string condition types", testStringConiditionsMatch)
+		t.Run("ip conidition types", testIPConditionMatch)
+		t.Run("unknown condition type", func(t *testing.T) {
+			ch := Chain{Rules: []Rule{{
+				Status:    Allow,
+				Actions:   Actions{Names: []string{native.MethodPutObject}},
+				Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+				Condition: []Condition{{
+					Op:    ConditionType(255),
+					Kind:  KindRequest,
+					Key:   common.PropertyKeyFrostFSSourceIP,
+					Value: "192.92.1.1/20",
+				}},
+			}}}
+			resource := testutil.NewResource(native.ResourceFormatRootContainers, map[string]string{
+				native.PropertyKeyObjectID: "79xGoKYwhyJQhrDNb7bHhY1WCvN6trHJPTjKkw24c6W9",
+			})
+			request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+				common.PropertyKeyFrostFSSourceIP: "192.92.1.91",
+				native.PropertyKeyActorRole:       "owner",
+			})
+			require.PanicsWithValue(t, "unimplemented: 255", func() {
+				ch.Match(request)
+			})
+		})
+	})
+
+	t.Run("kind", func(t *testing.T) {
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, map[string]string{
+			native.PropertyKeyObjectID: "79xGoKYwhyJQhrDNb7bHhY1WCvN6trHJPTjKkw24c6W9",
+		})
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.92.1.91",
+			native.PropertyKeyActorRole:       "owner",
+		})
+
+		t.Run("resource", func(t *testing.T) {
+			cond := Condition{
+				Op:    CondStringEquals,
+				Kind:  KindResource,
+				Key:   native.PropertyKeyObjectID,
+				Value: "79xGoKYwhyJQhrDNb7bHhY1WCvN6trHJPTjKkw24c6W9",
+			}
+
+			found := cond.Match(request)
+			require.True(t, found)
+		})
+		t.Run("request", func(t *testing.T) {
+			cond := Condition{
+				Op:    CondStringEquals,
+				Kind:  KindRequest,
+				Key:   native.PropertyKeyActorRole,
+				Value: "owner",
+			}
+
+			found := cond.Match(request)
+			require.True(t, found)
+		})
+		t.Run("unknown", func(t *testing.T) {
+			cond := Condition{
+				Op:    CondStringEquals,
+				Kind:  ConditionKindType(255),
+				Key:   native.PropertyKeyActorRole,
+				Value: "owner",
+			}
+
+			require.PanicsWithValue(t, "unknown condition type: 255", func() {
+				cond.Match(request)
+			})
+		})
+	})
+}
+
+func testCondSliceContainsMatch(t *testing.T) {
 	propKey := common.PropertyKeyFrostFSIDGroupID
 	groupID := "1"

@ -99,7 +287,7 @@ func TestCondSliceContainsMatch(t *testing.T) {
 		Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
 		Condition: []Condition{{
 			Op:    CondSliceContains,
-			Object: ObjectRequest,
+			Kind:  KindRequest,
 			Key:   propKey,
 			Value: groupID,
 		}},
@ -151,7 +339,7 @@ func TestCondSliceContainsMatch(t *testing.T) {
 	}
 }

-func TestNumericConditionsMatch(t *testing.T) {
+func testNumericConditionsMatch(t *testing.T) {
 	propKey := s3.PropertyKeyMaxKeys

 	for _, tc := range []struct {
@ -165,19 +353,19 @@ func TestNumericConditionsMatch(t *testing.T) {
 			conditions: []Condition{
 				{
 					Op:    CondNumericLessThan,
-					Object: ObjectRequest,
+					Kind:  KindRequest,
 					Key:   propKey,
 					Value: "100",
 				},
 				{
 					Op:    CondNumericGreaterThan,
-					Object: ObjectRequest,
+					Kind:  KindRequest,
 					Key:   propKey,
 					Value: "80",
 				},
 				{
 					Op:    CondNumericNotEquals,
-					Object: ObjectRequest,
+					Kind:  KindRequest,
 					Key:   propKey,
 					Value: "91",
 				},
@ -190,19 +378,19 @@ func TestNumericConditionsMatch(t *testing.T) {
 			conditions: []Condition{
 				{
 					Op:    CondNumericEquals,
-					Object: ObjectRequest,
+					Kind:  KindRequest,
 					Key:   propKey,
 					Value: "50",
 				},
 				{
 					Op:    CondNumericLessThanEquals,
-					Object: ObjectRequest,
+					Kind:  KindRequest,
 					Key:   propKey,
 					Value: "50",
 				},
 				{
 					Op:    CondNumericGreaterThanEquals,
-					Object: ObjectRequest,
+					Kind:  KindRequest,
 					Key:   propKey,
 					Value: "50",
 				},
@ -227,7 +415,428 @@ func TestNumericConditionsMatch(t *testing.T) {
 	}
 }

+func testStringConiditionsMatch(t *testing.T) {
+	propKey := fmt.Sprintf(common.PropertyKeyFormatFrostFSIDUserClaim, "some-tag")
+	val := "tag-value"
+
+	t.Run(CondStringEquals.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondStringEquals,
+				Kind:  KindRequest,
+				Key:   propKey,
+				Value: val,
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val,
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: "distort_tag_value" + val,
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run(CondStringNotEquals.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondStringNotEquals,
+				Kind:  KindRequest,
+				Key:   propKey,
+				Value: val,
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: "distort_tag_value" + val,
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val,
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run(CondStringEqualsIgnoreCase.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondStringEqualsIgnoreCase,
+				Kind:  KindRequest,
+				Key:   propKey,
+				Value: val,
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: strings.ToUpper(val),
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: strings.ToUpper("distort_tag_value" + val),
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run(CondStringNotEqualsIgnoreCase.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondStringNotEqualsIgnoreCase,
+				Kind:  KindRequest,
+				Key:   propKey,
+				Value: val,
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: strings.ToUpper("distort_tag_value" + val),
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: strings.ToUpper(val),
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run(CondStringLike.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondStringLike,
+				Kind:  KindRequest,
+				Key:   propKey,
+				Value: val + "*",
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val + "suffix",
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: string([]byte(val)[:len(val)-1]), //cut last letter
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run(CondStringNotLike.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondStringNotLike,
+				Kind:  KindRequest,
+				Key:   propKey,
+				Value: "prefix" + val + "*",
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val + "suffix",
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: "prefix" + val,
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run(CondStringLessThan.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondStringLessThan,
+				Kind:  KindRequest,
+				Key:   propKey,
+				Value: val + "b",
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val + "a",
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val + "c",
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run(CondStringLessThanEquals.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondStringLessThanEquals,
+				Kind:  KindRequest,
+				Key:   propKey,
+				Value: val + "b",
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val + "a",
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val + "b",
+		})
+
+		st, found = ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+	})
+
+	t.Run(CondStringGreaterThan.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondStringGreaterThan,
+				Kind:  KindRequest,
+				Key:   propKey,
+				Value: val + "b",
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val + "c",
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val + "b",
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run(CondStringGreaterThanEquals.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondStringGreaterThanEquals,
+				Kind:  KindRequest,
+				Key:   propKey,
+				Value: val + "b",
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val + "c",
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			propKey: val + "b",
+		})
+
+		st, found = ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+	})
+}
+
+func testIPConditionMatch(t *testing.T) {
+	t.Run(CondIPAddress.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondIPAddress,
+				Kind:  KindRequest,
+				Key:   common.PropertyKeyFrostFSSourceIP,
+				Value: "192.92.1.1/20",
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.92.1.91",
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.93.1.91",
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run(CondNotIPAddress.String(), func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondNotIPAddress,
+				Kind:  KindRequest,
+				Key:   common.PropertyKeyFrostFSSourceIP,
+				Value: "192.92.1.1/20",
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.93.1.91",
+		})
+
+		st, found := ch.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+
+		request = testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.92.1.91",
+		})
+
+		st, found = ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run("invalid ip address condition value", func(t *testing.T) {
+		ch := Chain{Rules: []Rule{{
+			Status:    Allow,
+			Actions:   Actions{Names: []string{native.MethodPutObject}},
+			Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+			Condition: []Condition{{
+				Op:    CondIPAddress,
+				Kind:  KindRequest,
+				Key:   common.PropertyKeyFrostFSSourceIP,
+				Value: "192.92.1.1:33333",
+			}},
+		}}}
+
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.92.1.91",
+		})
+
+		st, found := ch.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run("match ip", func(t *testing.T) {
+		cond := Condition{
+			Op:    CondIPAddress,
+			Kind:  KindRequest,
+			Key:   common.PropertyKeyFrostFSSourceIP,
+			Value: "192.92.1.1/10",
+		}
+
+		require.NotPanics(t, func() {
+			cond.matchIP("192.92.1.91")
+		})
+
+		require.PanicsWithValue(t, "unimplemented: 10", func() {
+			cond.Op = CondNumericEquals
+			cond.matchIP("192.92.1.91")
+		})
+	})
+}
+
 func TestInvalidNumericValues(t *testing.T) {
+	t.Run("invalid request property", func(t *testing.T) {
 		propKey := s3.PropertyKeyMaxKeys
 		propValues := []string{"", "invalid"}

@ -271,7 +880,7 @@ func TestInvalidNumericValues(t *testing.T) {
 				resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
 				condition := Condition{
 					Op:    tc.conditionType,
-				Object: ObjectRequest,
+					Kind:  KindRequest,
 					Key:   propKey,
 					Value: "50",
 				}
@ -284,4 +893,136 @@ func TestInvalidNumericValues(t *testing.T) {
 				}
 			})
 		}
+	})
+	t.Run("invalid condition numeric value", func(t *testing.T) {
+		propKey := s3.PropertyKeyMaxKeys
+
+		condition := Condition{
+			Kind:  KindRequest,
+			Key:   propKey,
+			Value: "invalid",
+		}
+
+		t.Run("match on CondNumericNotEquals", func(t *testing.T) {
+			condition.Op = CondNumericNotEquals
+
+			resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+			request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{propKey: "50"})
+
+			match := condition.Match(request)
+			require.Equal(t, true, match)
+		})
+
+		t.Run("non-match on non-CondNumericNotEquals", func(t *testing.T) {
+			condition.Op = CondNumericEquals
+
+			resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+			request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{propKey: "50"})
+
+			match := condition.Match(request)
+			require.Equal(t, false, match)
+		})
+
+		t.Run("match numeric", func(t *testing.T) {
+			cond := Condition{
+				Op:    CondNumericLessThan,
+				Kind:  KindRequest,
+				Key:   s3.PropertyKeyMaxKeys,
+				Value: "5",
+			}
+
+			require.NotPanics(t, func() {
+				cond.matchNumeric("6")
+			})
+
+			require.PanicsWithValue(t, "unimplemented: 0", func() {
+				cond.Op = CondStringEquals
+				cond.matchNumeric("10")
+			})
+		})
+	})
+}
+
+func TestCondTypeStringification(t *testing.T) {
+	for _, pair := range []struct {
+		cond           ConditionType
+		expectedString string
+	}{
+		{CondStringEquals, "StringEquals"},
+		{CondStringNotEquals, "StringNotEquals"},
+		{CondStringEqualsIgnoreCase, "StringEqualsIgnoreCase"},
+		{CondStringNotEqualsIgnoreCase, "StringNotEqualsIgnoreCase"},
+		{CondStringLike, "StringLike"},
+		{CondStringNotLike, "StringNotLike"},
+		{CondStringLessThan, "StringLessThan"},
+		{CondStringLessThanEquals, "StringLessThanEquals"},
+		{CondStringGreaterThan, "StringGreaterThan"},
+		{CondStringGreaterThanEquals, "StringGreaterThanEquals"},
+		{CondNumericEquals, "NumericEquals"},
+		{CondNumericNotEquals, "NumericNotEquals"},
+		{CondNumericLessThan, "NumericLessThan"},
+		{CondNumericLessThanEquals, "NumericLessThanEquals"},
+		{CondNumericGreaterThan, "NumericGreaterThan"},
+		{CondNumericGreaterThanEquals, "NumericGreaterThanEquals"},
+		{CondSliceContains, "SliceContains"},
+		{CondIPAddress, "IPAddress"},
+		{CondNotIPAddress, "NotIPAddress"},
+		{ConditionType(255), "unknown condition type"},
+	} {
+		require.Equal(t, pair.expectedString, pair.cond.String())
+	}
+}
+
+func TestRuleMatch(t *testing.T) {
+	rule := Rule{
+		Status:    Allow,
+		Actions:   Actions{Names: []string{native.MethodPutObject}},
+		Resources: Resources{Names: []string{native.ResourceFormatRootContainers}},
+		Condition: []Condition{{
+			Op:    CondIPAddress,
+			Kind:  KindRequest,
+			Key:   common.PropertyKeyFrostFSSourceIP,
+			Value: "192.92.1.1/20",
+		}},
+	}
+
+	t.Run("match", func(t *testing.T) {
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.92.1.91",
+		})
+		st, found := rule.Match(request)
+		require.True(t, found)
+		require.Equal(t, Allow, st)
+	})
+
+	t.Run("not matching resource name", func(t *testing.T) {
+		resource := testutil.NewResource(fmt.Sprintf(native.ResourceFormatNamespaceContainers, "namespicy"), nil)
+		request := testutil.NewRequest(native.MethodPutObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.92.1.91",
+		})
+		st, found := rule.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run("not matching action", func(t *testing.T) {
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodGetObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.92.1.91",
+		})
+		st, found := rule.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
+
+	t.Run("not matching condition", func(t *testing.T) {
+		resource := testutil.NewResource(native.ResourceFormatRootContainers, nil)
+		request := testutil.NewRequest(native.MethodGetObject, resource, map[string]string{
+			common.PropertyKeyFrostFSSourceIP: "192.93.1.91",
+		})
+		st, found := rule.Match(request)
+		require.False(t, found)
+		require.Equal(t, NoRuleFound, st)
+	})
 }
--- a/pkg/chain/marshal_binary.go
+++ b/pkg/chain/marshal_binary.go
@ -218,7 +218,7 @@ func marshalCondition(buf []byte, offset int, c Condition) (int, error) {
 	if err != nil {
 		return 0, err
 	}
-	offset, err = marshal.ByteMarshal(buf, offset, byte(c.Object))
+	offset, err = marshal.ByteMarshal(buf, offset, byte(c.Kind))
 	if err != nil {
 		return 0, err
 	}
@ -241,7 +241,7 @@ func unmarshalCondition(buf []byte, offset int) (Condition, int, error) {
 	if err != nil {
 		return Condition{}, 0, err
 	}
-	c.Object = ObjectType(obV)
+	c.Kind = ConditionKindType(obV)

 	c.Key, offset, err = marshal.StringUnmarshal(buf, offset)
 	if err != nil {
--- a/pkg/chain/marshal_binary_test.go
+++ b/pkg/chain/marshal_binary_test.go
@ -28,31 +28,6 @@ func TestInvalidChainData(t *testing.T) {
 	require.Error(t, ch.UnmarshalBinary([]byte("\x00\x00:aws:iam::namespace:group/so\x82\x82\x82\x82\x82\x82u\x82")))
 }

-func FuzzUnmarshal(f *testing.F) {
-	for _, id := range generateTestIDs() {
-		for _, rules := range generateTestRules() {
-			for _, matchType := range generateTestMatchTypes() {
-
-				chain := Chain{
-					ID:        id,
-					Rules:     rules,
-					MatchType: matchType,
-				}
-				data, err := chain.MarshalBinary()
-				require.NoError(f, err)
-				f.Add(data)
-			}
-		}
-	}
-
-	f.Fuzz(func(t *testing.T, data []byte) {
-		var ch Chain
-		require.NotPanics(t, func() {
-			_ = ch.UnmarshalBinary(data)
-		})
-	})
-}
-
 func performMarshalTest(t *testing.T, id ID, r []Rule, mt MatchType) {
 	chain := Chain{
 		ID:        id,
@ -204,28 +179,28 @@ func generateTestConditions() [][]Condition {
 		for _, ot := range generateObjectTypes() {
 			result[2] = append(result[2], Condition{
 				Op:    ct,
-				Object: ot,
+				Kind:  ot,
 				Key:   "",
 				Value: "",
 			})

 			result[2] = append(result[2], Condition{
 				Op:    ct,
-				Object: ot,
+				Kind:  ot,
 				Key:   "key",
 				Value: "",
 			})

 			result[2] = append(result[2], Condition{
 				Op:    ct,
-				Object: ot,
+				Kind:  ot,
 				Key:   "",
 				Value: "value",
 			})

 			result[2] = append(result[2], Condition{
 				Op:    ct,
-				Object: ot,
+				Kind:  ot,
 				Key:   "key",
 				Value: "value",
 			})
@ -257,10 +232,10 @@ func generateTestConditionTypes() []ConditionType {
 	}
 }

-func generateObjectTypes() []ObjectType {
-	return []ObjectType{
-		ObjectResource,
-		ObjectRequest,
+func generateObjectTypes() []ConditionKindType {
+	return []ConditionKindType{
+		KindResource,
+		KindRequest,
 	}
 }

--- a/pkg/chain/marshal_fuzz.go
+++ b/pkg/chain/marshal_fuzz.go
@ -0,0 +1,13 @@
+//go:build gofuzz
+// +build gofuzz
+
+package chain
+
+func DoFuzzChainUnmarshalBinary(data []byte) int {
+	var ch Chain
+	err := ch.UnmarshalBinary(data)
+	if err != nil {
+		return 0
+	}
+	return 1
+}
--- a/pkg/chain/marshal_fuzz_test.go
+++ b/pkg/chain/marshal_fuzz_test.go
@ -0,0 +1,34 @@
+//go:build gofuzz
+// +build gofuzz
+
+package chain
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func FuzzUnmarshal(f *testing.F) {
+	for _, id := range generateTestIDs() {
+		for _, rules := range generateTestRules() {
+			for _, matchType := range generateTestMatchTypes() {
+
+				chain := Chain{
+					ID:        id,
+					Rules:     rules,
+					MatchType: matchType,
+				}
+				data, err := chain.MarshalBinary()
+				require.NoError(f, err)
+				f.Add(data)
+			}
+		}
+	}
+
+	f.Fuzz(func(t *testing.T, data []byte) {
+		require.NotPanics(t, func() {
+			DoFuzzChainUnmarshalBinary(data)
+		})
+	})
+}
--- a/pkg/chain/marshal_json.go
+++ b/pkg/chain/marshal_json.go
@ -29,11 +29,11 @@ var statusToJSONValue = []struct {
 }

 var objectTypeToJSONValue = []struct {
-	t   ObjectType
+	t   ConditionKindType
 	str string
 }{
-	{ObjectRequest, "Request"},
-	{ObjectResource, "Resource"},
+	{KindRequest, "Request"},
+	{KindResource, "Resource"},
 }

 func (mt MatchType) MarshalEasyJSON(w *jwriter.Writer) {
@ -90,7 +90,7 @@ func (st *Status) UnmarshalEasyJSON(l *jlexer.Lexer) {
 	*st = Status(v)
 }

-func (ot ObjectType) MarshalEasyJSON(w *jwriter.Writer) {
+func (ot ConditionKindType) MarshalEasyJSON(w *jwriter.Writer) {
 	for _, p := range objectTypeToJSONValue {
 		if p.t == ot {
 			w.String(p.str)
@ -100,7 +100,7 @@ func (ot ObjectType) MarshalEasyJSON(w *jwriter.Writer) {
 	w.String(strconv.FormatUint(uint64(ot), 10))
 }

-func (ot *ObjectType) UnmarshalEasyJSON(l *jlexer.Lexer) {
+func (ot *ConditionKindType) UnmarshalEasyJSON(l *jlexer.Lexer) {
 	str := l.String()
 	for _, p := range objectTypeToJSONValue {
 		if p.str == str {
@ -114,7 +114,7 @@ func (ot *ObjectType) UnmarshalEasyJSON(l *jlexer.Lexer) {
 		l.AddError(fmt.Errorf("failed to parse object type: %w", err))
 		return
 	}
-	*ot = ObjectType(v)
+	*ot = ConditionKindType(v)
 }

 func (ct ConditionType) MarshalEasyJSON(w *jwriter.Writer) {
--- a/pkg/chain/marshal_json_test.go
+++ b/pkg/chain/marshal_json_test.go
@ -69,7 +69,7 @@ func TestJsonEnums(t *testing.T) {
 				Condition: []Condition{
 					{
 						Op:    CondStringEquals,
-						Object: ObjectRequest,
+						Kind:  KindRequest,
 						Key:   native.PropertyKeyActorRole,
 						Value: native.PropertyValueContainerRoleOthers,
 					},
@ -88,7 +88,7 @@ func TestJsonEnums(t *testing.T) {
 				Condition: []Condition{
 					{
 						Op:    CondStringNotLike,
-						Object: ObjectResource,
+						Kind:  KindResource,
 						Key:   native.PropertyKeyObjectType,
 						Value: "regular",
 					},
@ -99,7 +99,7 @@ func TestJsonEnums(t *testing.T) {
 				Condition: []Condition{
 					{
 						Op:   ConditionType(255),
-						Object: ObjectType(128),
+						Kind: ConditionKindType(128),
 					},
 				},
 			},
--- a/pkg/chain/testdata/test_status_json.json
+++ b/pkg/chain/testdata/test_status_json.json
@ -20,7 +20,7 @@
            "Condition": [
                {
                    "Op": "StringEquals",
-                    "Object": "Request",
+                    "Kind": "Request",
                    "Key": "$Actor:role",
                    "Value": "others"
                }
@ -44,7 +44,7 @@
            "Condition": [
                {
                    "Op": "StringNotLike",
-                    "Object": "Resource",
+                    "Kind": "Resource",
                    "Key": "$Object:objectType",
                    "Value": "regular"
                }
@ -64,7 +64,7 @@
            "Condition": [
                {
                    "Op": "255",
-                    "Object": "128",
+                    "Kind": "128",
                    "Key": "",
                    "Value": ""
                }
--- a/pkg/engine/chain_router.go
+++ b/pkg/engine/chain_router.go
@ -42,43 +42,36 @@ func (dr *defaultChainRouter) checkLocal(name chain.Name, rt RequestTarget, r re
 	if dr.local == nil {
 		return
 	}
-	var ruleFounds []bool
+
+	var hasAllow bool
 	for _, target := range rt.Targets() {
 		status, ruleFound, err = dr.matchLocalOverrides(name, target, r)
 		if err != nil || ruleFound && status != chain.Allow {
 			return
 		}
-		ruleFounds = append(ruleFounds, ruleFound)
+		hasAllow = hasAllow || ruleFound
 	}

-	status = chain.NoRuleFound
-	for _, ruleFound = range ruleFounds {
-		if ruleFound {
-			status = chain.Allow
-			break
+	if hasAllow {
+		return chain.Allow, true, nil
 	}
-	}
-	return
+	return chain.NoRuleFound, false, nil
 }

 func (dr *defaultChainRouter) checkMorph(name chain.Name, rt RequestTarget, r resource.Request) (status chain.Status, ruleFound bool, err error) {
-	var ruleFounds []bool
+	var hasAllow bool
 	for _, target := range rt.Targets() {
 		status, ruleFound, err = dr.matchMorphRuleChains(name, target, r)
 		if err != nil || ruleFound && status != chain.Allow {
 			return
 		}
-		ruleFounds = append(ruleFounds, ruleFound)
+		hasAllow = hasAllow || ruleFound
 	}

-	status = chain.NoRuleFound
-	for _, ruleFound = range ruleFounds {
-		if ruleFound {
-			status = chain.Allow
-			break
+	if hasAllow {
+		return chain.Allow, true, nil
 	}
-	}
-	return
+	return chain.NoRuleFound, false, nil
 }

 func (dr *defaultChainRouter) matchLocalOverrides(name chain.Name, target Target, r resource.Request) (status chain.Status, ruleFound bool, err error) {
--- a/pkg/engine/inmemory/inmemory_test.go
+++ b/pkg/engine/inmemory/inmemory_test.go
@ -31,6 +31,49 @@ func TestAddRootOverrides(t *testing.T) {
 	require.Equal(t, string(id), string(res[0].ID))
 }

+func TestInmemory_MultipleTargets(t *testing.T) {
+	const op = "ape::test::op"
+
+	targets := []engine.Target{
+		engine.NamespaceTarget("ns1"),
+		engine.ContainerTarget("cnr1"),
+		engine.GroupTarget("group1"),
+		engine.UserTarget("user1"),
+	}
+	req := resourcetest.NewRequest(op, resourcetest.NewResource("r", nil), nil)
+	target := engine.NewRequestTargetExtended("ns1", "cnr1", "user1", []string{"group1"})
+	for _, tt := range targets {
+		t.Run("morph", func(t *testing.T) {
+			s := NewInMemoryLocalOverrides()
+			s.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, tt, &chain.Chain{
+				Rules: []chain.Rule{{
+					Status:  chain.Allow,
+					Actions: chain.Actions{Names: []string{op}},
+				}},
+			})
+
+			status, found, err := s.IsAllowed(chain.Ingress, target, req)
+			require.NoError(t, err)
+			require.True(t, found)
+			require.Equal(t, chain.Allow, status)
+		})
+		t.Run("override", func(t *testing.T) {
+			s := NewInMemoryLocalOverrides()
+			s.LocalStorage().AddOverride(chain.Ingress, tt, &chain.Chain{
+				Rules: []chain.Rule{{
+					Status:  chain.Allow,
+					Actions: chain.Actions{Names: []string{op}},
+				}},
+			})
+
+			status, found, err := s.IsAllowed(chain.Ingress, target, req)
+			require.NoError(t, err)
+			require.True(t, found)
+			require.Equal(t, chain.Allow, status)
+		})
+	}
+}
+
 func TestInmemory(t *testing.T) {
 	const (
 		object     = "native::object::abc/xyz"
@ -70,13 +113,13 @@ func TestInmemory(t *testing.T) {
 				Condition: []chain.Condition{
 					{
 						Op:    chain.CondStringNotLike,
-						Object: chain.ObjectRequest,
+						Kind:  chain.KindRequest,
 						Key:   "SourceIP",
 						Value: "10.1.1.*",
 					},
 					{
 						Op:    chain.CondStringNotEquals,
-						Object: chain.ObjectRequest,
+						Kind:  chain.KindRequest,
 						Key:   "Actor",
 						Value: actor1,
 					},
@ -112,13 +155,13 @@ func TestInmemory(t *testing.T) {
 				Condition: []chain.Condition{
 					{
 						Op:    chain.CondStringEquals,
-						Object: chain.ObjectResource,
+						Kind:  chain.KindResource,
 						Key:   "Department",
 						Value: "HR",
 					},
 					{
 						Op:    chain.CondStringEquals,
-						Object: chain.ObjectRequest,
+						Kind:  chain.KindRequest,
 						Key:   "Actor",
 						Value: actor2,
 					},
--- a/pkg/engine/inmemory/morph_storage.go
+++ b/pkg/engine/inmemory/morph_storage.go
@ -21,7 +21,7 @@ func NewInmemoryMorphRuleChainStorage() engine.MorphRuleChainStorage {

 func (s *inmemoryMorphRuleChainStorage) AddMorphRuleChain(name chain.Name, target engine.Target, c *chain.Chain) (_ util.Uint256, _ uint32, err error) {
 	switch target.Type {
-	case engine.Namespace, engine.Container:
+	case engine.Namespace, engine.Container, engine.User, engine.Group:
 		_, err = s.storage.AddOverride(name, target, c)
 	default:
 		err = engine.ErrUnknownTarget
@ -31,7 +31,7 @@ func (s *inmemoryMorphRuleChainStorage) AddMorphRuleChain(name chain.Name, targe

 func (s *inmemoryMorphRuleChainStorage) RemoveMorphRuleChain(name chain.Name, target engine.Target, chainID chain.ID) (_ util.Uint256, _ uint32, err error) {
 	switch target.Type {
-	case engine.Namespace, engine.Container:
+	case engine.Namespace, engine.Container, engine.User, engine.Group:
 		err = s.storage.RemoveOverride(name, target, chainID)
 	default:
 		err = engine.ErrUnknownTarget
@ -41,7 +41,7 @@ func (s *inmemoryMorphRuleChainStorage) RemoveMorphRuleChain(name chain.Name, ta

 func (s *inmemoryMorphRuleChainStorage) RemoveMorphRuleChainsByTarget(name chain.Name, target engine.Target) (_ util.Uint256, _ uint32, err error) {
 	switch target.Type {
-	case engine.Namespace, engine.Container:
+	case engine.Namespace, engine.Container, engine.User, engine.Group:
 		err = s.storage.RemoveOverridesByTarget(name, target)
 	default:
 		err = engine.ErrUnknownTarget
@ -51,7 +51,7 @@ func (s *inmemoryMorphRuleChainStorage) RemoveMorphRuleChainsByTarget(name chain

 func (s *inmemoryMorphRuleChainStorage) ListMorphRuleChains(name chain.Name, target engine.Target) ([]*chain.Chain, error) {
 	switch target.Type {
-	case engine.Namespace, engine.Container:
+	case engine.Namespace, engine.Container, engine.User, engine.Group:
 		return s.storage.ListOverrides(name, target)
 	default:
 	}
--- a/pkg/engine/interface.go
+++ b/pkg/engine/interface.go
@ -37,6 +37,8 @@ type TargetType rune
 const (
 	Namespace TargetType = 'n'
 	Container TargetType = 'c'
+	User      TargetType = 'u'
+	Group     TargetType = 'g'
 )

 type Target struct {
@ -48,6 +50,8 @@ type Target struct {
 type RequestTarget struct {
 	Namespace *Target
 	Container *Target
+	User      *Target
+	Groups    []Target
 }

 func NewRequestTargetWithNamespace(namespace string) RequestTarget {
@ -73,6 +77,24 @@ func NewRequestTarget(namespace, container string) RequestTarget {
 	}
 }

+func NewRequestTargetExtended(namespace, container, user string, groups []string) RequestTarget {
+	nt := NamespaceTarget(namespace)
+	ct := ContainerTarget(container)
+	u := UserTarget(user)
+	rt := RequestTarget{
+		Namespace: &nt,
+		Container: &ct,
+		User:      &u,
+	}
+	if len(groups) != 0 {
+		rt.Groups = make([]Target, len(groups))
+		for i := range groups {
+			rt.Groups[i] = GroupTarget(groups[i])
+		}
+	}
+	return rt
+}
+
 func (rt *RequestTarget) Targets() (targets []Target) {
 	if rt.Namespace != nil {
 		targets = append(targets, *rt.Namespace)
@ -80,6 +102,12 @@ func (rt *RequestTarget) Targets() (targets []Target) {
 	if rt.Container != nil {
 		targets = append(targets, *rt.Container)
 	}
+	if rt.User != nil {
+		targets = append(targets, *rt.User)
+	}
+	if len(rt.Groups) != 0 {
+		targets = append(targets, rt.Groups...)
+	}
 	return
 }

@ -97,6 +125,20 @@ func ContainerTarget(container string) Target {
 	}
 }

+func UserTarget(user string) Target {
+	return Target{
+		Type: User,
+		Name: user,
+	}
+}
+
+func GroupTarget(group string) Target {
+	return Target{
+		Type: Group,
+		Name: group,
+	}
+}
+
 // MorphRuleChainStorageReader is the interface that provides read-only methods to receive
 // data like chains, target or admin from a chain storage.
 type MorphRuleChainStorageReader interface {
--- a/pkg/morph/policy/policy_contract_storage.go
+++ b/pkg/morph/policy/policy_contract_storage.go
@ -6,6 +6,7 @@ import (
 	"math/big"
 	"strings"

+	"git.frostfs.info/TrueCloudLab/frostfs-contract/commonclient"
 	"git.frostfs.info/TrueCloudLab/frostfs-contract/policy"
 	client "git.frostfs.info/TrueCloudLab/frostfs-contract/rpcclient/policy"
 	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
@ -13,6 +14,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/nspcc-dev/neo-go/pkg/neorpc/result"
 	"github.com/nspcc-dev/neo-go/pkg/rpcclient/actor"
+	neoinvoker "github.com/nspcc-dev/neo-go/pkg/rpcclient/invoker"
 	"github.com/nspcc-dev/neo-go/pkg/util"
 	"github.com/nspcc-dev/neo-go/pkg/vm/stackitem"
 	"github.com/nspcc-dev/neo-go/pkg/wallet"
@ -26,6 +28,10 @@ var (

 // ContractStorage is the interface to manage chain rules within Policy contract.
 type ContractStorage struct {
+	hash util.Uint160
+
+	actor ContractStorageActor
+
 	contractInterface *client.Contract
 }

@ -33,23 +39,49 @@ var _ engine.MorphRuleChainStorage = (*ContractStorage)(nil)

 // ContractStorageReader is the interface to read data from Policy contract.
 type ContractStorageReader struct {
+	hash util.Uint160
+
+	invoker ContractStorageInvoker
+
 	contractReaderInterface *client.ContractReader
 }

+type ContractStorageActor interface {
+	client.Actor
+	GetRPCInvoker() neoinvoker.RPCInvoke
+}
+
 var _ engine.MorphRuleChainStorageReader = (*ContractStorageReader)(nil)

-func NewContractStorage(actor client.Actor, contract util.Uint160) *ContractStorage {
+func NewContractStorage(actor ContractStorageActor, contract util.Uint160) *ContractStorage {
 	return &ContractStorage{
+		hash:              contract,
+		actor:             actor,
 		contractInterface: client.New(actor, contract),
 	}
 }

+type contractStorageActorImpl struct {
+	client.Actor
+	rpcActor actor.RPCActor
+}
+
+var _ ContractStorageActor = &contractStorageActorImpl{}
+
+func (c *contractStorageActorImpl) GetRPCInvoker() neoinvoker.RPCInvoke {
+	return c.rpcActor
+}
+
+// NewContractStorageWithSimpleActor constructs core actor from `rpcActor`.
+//
+// Note: NewContractStorageWithSimpleActor is appropriate only for call-only-once cases (for example, in CLIs). Otherwise, it is unsafe,
+// because core actor may use invalidated `rpcActor` if some connection errors occurred.
 func NewContractStorageWithSimpleActor(rpcActor actor.RPCActor, acc *wallet.Account, contract util.Uint160) (*ContractStorage, error) {
 	act, err := actor.NewSimple(rpcActor, acc)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create simple actor: %w", err)
 	}
-	return NewContractStorage(act, contract), nil
+	return NewContractStorage(&contractStorageActorImpl{Actor: act, rpcActor: rpcActor}, contract), nil
 }

 func (s *ContractStorage) AddMorphRuleChain(name chain.Name, target engine.Target, c *chain.Chain) (txHash util.Uint256, vub uint32, err error) {
@ -98,17 +130,26 @@ func (s *ContractStorage) RemoveMorphRuleChainsByTarget(name chain.Name, target
 	return
 }

-func (s *ContractStorage) ListMorphRuleChains(name chain.Name, target engine.Target) ([]*chain.Chain, error) {
+func listChains(name chain.Name, target engine.Target, rpcInvoker neoinvoker.RPCInvoke, hash util.Uint160) ([]*chain.Chain, error) {
 	kind, err := policyKind(target.Type)
 	if err != nil {
 		return nil, err
 	}

-	items, err := s.contractInterface.ListChainsByPrefix(big.NewInt(int64(kind)), target.Name, []byte(name))
-	if err != nil {
-		return nil, err
+	const (
+		method    = "iteratorChainsByPrefix"
+		batchSize = neoinvoker.DefaultIteratorResultItems
+	)
+
+	inv := neoinvoker.New(rpcInvoker, nil)
+	params := []any{
+		big.NewInt(int64(kind)), target.Name, []byte(name),
 	}

+	items, err := commonclient.ReadIteratorItems(inv, batchSize, hash, method, params...)
+	if err != nil {
+		return nil, fmt.Errorf("read items error: %w", err)
+	}
 	var chains []*chain.Chain
 	for _, item := range items {
 		serialized, err := bytesFromStackItem(item)
@ -121,10 +162,13 @@ func (s *ContractStorage) ListMorphRuleChains(name chain.Name, target engine.Tar
 		}
 		chains = append(chains, c)
 	}
-
 	return chains, nil
 }

+func (s *ContractStorage) ListMorphRuleChains(name chain.Name, target engine.Target) ([]*chain.Chain, error) {
+	return listChains(name, target, s.actor.GetRPCInvoker(), s.hash)
+}
+
 func (s *ContractStorage) ListTargetsIterator(targetType engine.TargetType) (uuid.UUID, result.Iterator, error) {
 	kind, err := policyKind(targetType)
 	if err != nil {
@ -141,37 +185,21 @@ func (s *ContractStorage) SetAdmin(addr util.Uint160) (util.Uint256, uint32, err
 	return s.contractInterface.SetAdmin(addr)
 }

-func NewContractStorageReader(inv client.Invoker, contract util.Uint160) *ContractStorageReader {
+type ContractStorageInvoker interface {
+	client.Invoker
+	GetRPCInvoker() neoinvoker.RPCInvoke
+}
+
+func NewContractStorageReader(inv ContractStorageInvoker, contract util.Uint160) *ContractStorageReader {
 	return &ContractStorageReader{
+		hash:                    contract,
+		invoker:                 inv,
 		contractReaderInterface: client.NewReader(inv, contract),
 	}
 }

 func (s *ContractStorageReader) ListMorphRuleChains(name chain.Name, target engine.Target) ([]*chain.Chain, error) {
-	kind, err := policyKind(target.Type)
-	if err != nil {
-		return nil, err
-	}
-
-	items, err := s.contractReaderInterface.ListChainsByPrefix(big.NewInt(int64(kind)), target.Name, []byte(name))
-	if err != nil {
-		return nil, err
-	}
-
-	var chains []*chain.Chain
-	for _, item := range items {
-		serialized, err := bytesFromStackItem(item)
-		if err != nil {
-			return nil, err
-		}
-		c := new(chain.Chain)
-		if err := c.DecodeBytes(serialized); err != nil {
-			return nil, err
-		}
-		chains = append(chains, c)
-	}
-
-	return chains, nil
+	return listChains(name, target, s.invoker.GetRPCInvoker(), s.hash)
 }

 func (s *ContractStorageReader) GetAdmin() (util.Uint160, error) {
@ -205,10 +233,16 @@ func prefixedChainName(name chain.Name, chainID chain.ID) []byte {
 }

 func policyKind(typ engine.TargetType) (policy.Kind, error) {
-	if typ == engine.Namespace {
+	switch typ {
+	case engine.Namespace:
 		return policy.Namespace, nil
-	} else if typ == engine.Container {
+	case engine.Container:
 		return policy.Container, nil
-	}
+	case engine.User:
+		return policy.Kind(engine.User), nil
+	case engine.Group:
+		return policy.Kind(engine.Group), nil
+	default:
 		return policy.Kind(0), ErrEngineTargetTypeUnsupported
+	}
 }
--- a/schema/common/consts.go
+++ b/schema/common/consts.go
@ -3,5 +3,9 @@ package common
 const (
 	PropertyKeyFrostFSIDGroupID = "frostfsid:groupID"

+	PropertyKeyFrostFSSourceIP = "frostfs:sourceIP"
+
 	PropertyKeyFormatFrostFSIDUserClaim = "frostfsid:userClaim/%s"
+
+	PropertyKeyFrostFSXHeader = "frostfs:xheader/%s"
 )
--- a/schema/native/consts.go
+++ b/schema/native/consts.go
@ -8,6 +8,7 @@ const (
 	MethodSearchObject = "SearchObject"
 	MethodRangeObject  = "RangeObject"
 	MethodHashObject   = "HashObject"
+	MethodPatchObject  = "PatchObject"

 	MethodPutContainer     = "PutContainer"
 	MethodDeleteContainer  = "DeleteContainer"
--- a/schema/s3/consts.go
+++ b/schema/s3/consts.go
@ -11,6 +11,9 @@ const (
 	PropertyKeyFormatResourceTag = "aws:ResourceTag/%s"
 	PropertyKeyFormatRequestTag  = "aws:RequestTag/%s"

+	PropertyKeyAccessBoxAttrMFA    = "AccessBox-Attribute/IAM-MFA"
+	PropertyKeyFormatAccessBoxAttr = "AccessBox-Attribute/%s"
+
 	ResourceFormatS3All           = "arn:aws:s3:::*"
 	ResourceFormatS3Bucket        = "arn:aws:s3:::%s"
 	ResourceFormatS3BucketObjects = "arn:aws:s3:::%s/*"
Author	SHA1	Message	Date
Marina Biryukova	a3bc3099bd	[#87 ] iam: Support s3:PatchObject action Signed-off-by: Marina Biryukova <m.biryukova@yadro.com>	2024-08-22 10:41:52 +00:00
Ekaterina Lebedeva	ed14db3e66	[#91 ] lint: Fix warnings Signed-off-by: Ekaterina Lebedeva <ekaterina.lebedeva@yadro.com>	2024-08-22 12:22:32 +03:00
Ekaterina Lebedeva	eb7be61798	[#91 ] go.mod: Bump go version to 1.22 Signed-off-by: Ekaterina Lebedeva <ekaterina.lebedeva@yadro.com>	2024-08-22 12:22:15 +03:00
Evgenii Stratonikov	a1386f6d25	[#90 ] engine: Fix ruleFound return value It can be false if the first targets allows operation and the last one returns NoRuleFound. Found by @mbiryukova. Introduced in #86. Signed-off-by: Evgenii Stratonikov <e.stratonikov@yadro.com>	2024-08-21 07:20:38 +00:00
Denis Kirillov	2300995af2	[#88 ] iam: Support lifecycle actions in native map Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>	2024-08-20 17:17:17 +03:00
Evgenii Stratonikov	a11e80e2c7	[#86 ] engine: Simplify multiple chains processing So, it's sunday evening and I am sitting on-call trying to debug strange node behaviour. It took me 3 whole minutes to understand the code being changed: it accumulates bools in slices, even though no slice is needed; it uses subtle condition from the first loop to make decision in the second one, and finally it uses named return values. In this commit we remove the slice and the second loop, because why not. Signed-off-by: Evgenii Stratonikov <e.stratonikov@yadro.com>	2024-08-19 09:37:38 +03:00
Airat Arifullin	96225afacb	[#85 ] schema: Introduce `PatchObject` method Signed-off-by: Airat Arifullin <aarifullin@yadro.com>	2024-08-14 11:02:54 +03:00
Airat Arifullin	2628f61849	[#84 ] schema: Introduce xheader property Signed-off-by: Airat Arifullin <aarifullin@yadro.com>	2024-07-12 11:14:03 +03:00
Denis Kirillov	ac965e8d17	[#80 ] iam: Move resource tag to resource property Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>	2024-06-11 13:29:30 +03:00
Denis Kirillov	64e06f5b7c	[#80 ] iam: Skip unsupported conditions in native chains Skip conditions with * aws:RequestTag * aws:ResourceTag keys Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>	2024-06-11 11:15:22 +03:00
Denis Kirillov	303a81cdc6	[#78 ] iam: Don't check IP for private Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>	2024-05-27 09:54:02 +03:00
Airat Arifullin	d7ed188f68	[#76 ] chain: Increase unit-test coverage for chain related types * Add more unit-test cases. Signed-off-by: Airat Arifullin <aarifullin@yadro.com>	2024-05-22 15:08:11 +03:00
aarifullin	1f6f4163d4	[#71 ] docs: Introduce APE overview Signed-off-by: Airat Arifullin <aarifullin@yadro.com>	2024-05-13 16:37:44 +00:00
Airat Arifullin	84c4872b20	[#75 ] chain: Refactor `ObjectType` type * Rename `ObjectType` to `Kind`; * Rename `Object` field in `Condition` to `ConditionKind`; * Regenerate easy-json marshalers/unmarshalers; * Fix unit-tests Signed-off-by: Airat Arifullin <aarifullin@yadro.com>	2024-05-13 17:36:17 +03:00
Airat Arifullin	e75200bb8e	[#75 ] chain: Remove `ContaierResource`, `ContainerRequest` constants Signed-off-by: Airat Arifullin <aarifullin@yadro.com>	2024-05-13 13:50:17 +03:00
Denis Kirillov	2e7518c453	[#74 ] docs: Describe converters Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>	2024-05-07 13:10:02 +03:00
Evgenii Stratonikov	2fa27b6557	[#72 ] chain/test: Refactor fuzz tests Make it possible to execute fuzz tests with different backend, such as go-fuzz which supports coverage collection. Signed-off-by: Evgenii Stratonikov <e.stratonikov@yadro.com>	2024-05-03 10:16:35 +00:00
Evgenii Stratonikov	38f947ac0a	[#73 ] pre-commit: Use cached tests in hook Signed-off-by: Evgenii Stratonikov <e.stratonikov@yadro.com>	2024-05-02 18:15:53 +03:00
Evgenii Stratonikov	34c1eafa56	[#73 ] Makefile: Allow to override test flags Signed-off-by: Evgenii Stratonikov <e.stratonikov@yadro.com>	2024-05-02 18:15:53 +03:00
Evgenii Stratonikov	84c15a559c	[#73 ] pre-commit: Remove gitlint hook It is annoying during local development and is unused on CI. Signed-off-by: Evgenii Stratonikov <e.stratonikov@yadro.com>	2024-05-02 18:15:53 +03:00
aarifullin	c539728641	[#62 ] morph: List morph rules chains by traversing iterator * Make `ListMorphRuleChains` methods use `commonclient.ReadIteratorItems`. * Introduce `ContractStorageActor` interface. * Iterators are used because listing by `ListChainsByPrefix` may cause stack overflow from neo-go side (len(items) > 1024). Signed-off-by: Airat Arifullin <aarifullin@yadro.com>	2024-04-26 06:20:43 +00:00
Marina Biryukova	04a79f57ef	[#70 ] iam: Support aws:MultiFactorAuthPresent key Signed-off-by: Marina Biryukova <m.biryukova@yadro.com>	2024-04-16 10:17:28 +03:00
Denis Kirillov	ff5d05ac92	[#67 ] chain: Support IPAddress conditions Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>	2024-04-15 12:52:41 +00:00
Evgenii Stratonikov	0e69e48511	[#64 ] engine: Add user and group targets Signed-off-by: Evgenii Stratonikov <e.stratonikov@yadro.com>	2024-04-12 16:07:34 +03:00
Denis Kirillov	530248de75	[#69 ] iam: Extend native actions with tree service methods Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>	2024-04-12 13:22:12 +03:00
Denis Kirillov	b6a6816800	[#68 ] iam: Allow read object on delete operation We must be able to read s3 multipart object from storage (to find out the parts it consists of) to fully delete such multipart object Signed-off-by: Denis Kirillov <d.kirillov@yadro.com>	2024-04-12 09:57:53 +03:00