From 33322e6638b00869d00a2397084a6e8a87e1e0f6 Mon Sep 17 00:00:00 2001 From: Taran Pelkey Date: Tue, 31 Oct 2023 15:30:36 -0400 Subject: [PATCH] Change behavior of service account empty policies (#18346) * Fix embedded/implied policy behavior * assume implied policy if pased to empty * fix for all * Fix failing tests --------- Co-authored-by: Prakash Senthil Vel <23444145+prakashsvmx@users.noreply.github.com> --- cmd/admin-handlers-users.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/cmd/admin-handlers-users.go b/cmd/admin-handlers-users.go index 263538566..5304590d8 100644 --- a/cmd/admin-handlers-users.go +++ b/cmd/admin-handlers-users.go @@ -781,6 +781,9 @@ func (a adminAPIHandlers) AddServiceAccount(w http.ResponseWriter, r *http.Reque writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) return } + if sp.Version == "" && len(sp.Statements) == 0 { + sp = nil + } } opts.sessionPolicy = sp @@ -911,6 +914,9 @@ func (a adminAPIHandlers) UpdateServiceAccount(w http.ResponseWriter, r *http.Re writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) return } + if sp.Version == "" && len(sp.Statements) == 0 { + sp = nil + } } opts := updateServiceAccountOpts{ secretKey: updateReq.NewSecretKey, @@ -996,9 +1002,12 @@ func (a adminAPIHandlers) InfoServiceAccount(w http.ResponseWriter, r *http.Requ } } + // if session policy is nil or empty, then it is implied policy + impliedPolicy := sessionPolicy == nil || (sessionPolicy.Version == "" && len(sessionPolicy.Statements) == 0) + var svcAccountPolicy policy.Policy - if sessionPolicy != nil { + if !impliedPolicy { svcAccountPolicy = *sessionPolicy } else { policiesNames, err := globalIAMSys.PolicyDBGet(svcAccount.ParentUser, false) @@ -1025,7 +1034,7 @@ func (a adminAPIHandlers) InfoServiceAccount(w http.ResponseWriter, r *http.Requ Name: svcAccount.Name, Description: svcAccount.Description, AccountStatus: svcAccount.Status, - ImpliedPolicy: sessionPolicy == nil, + ImpliedPolicy: impliedPolicy, Policy: string(policyJSON), Expiration: expiration, }