feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement

Fixes #1327
Fixes #1567
Closes #2264

Wires the S3 gateway up to the standalone IAM service so identity policies, not just bucket policies and ACLs, are enforced on the S3 data plane. The gateway authenticates SigV4 requests by calling new private derive-signing-key and resolve-identity endpoints on the IAM service instead of holding secrets itself, and evaluates identity policy through the same PolicyEvaluator path added to auth.VerifyAccess, combined with the bucket policy using explicit-deny-wins precedence. The private endpoints are served over their own mTLS listener (new iamapi/private package, genmtlscerts.sh to generate test material, and client-cert support in internal/netutil), separate from the public IAM API. As part of this the vendored aws/signer/v4 package is deleted and replaced by a pure-Go SigV4 implementation in internal/sigv4auth, which now reads canonical request data directly off the fiber.Ctx instead of reconstructing an http.Request, and is shared by both the S3 request-signing verification and the new private-endpoint signing.

DeleteObjects moves from an all-or-nothing authorization check to true partial success: VerifyObjectsAccess evaluates every object in a batch independently against both the identity policy and any object lock, so a denial or a locked object only removes that key from the batch instead of failing the whole request. It also batches the identity-policy round trip and the bucket-policy fetch once per request rather than once per object, and separates plain deletes from versioned ones since a versioned delete needs s3:DeleteObjectVersion rather than s3:DeleteObject. Object lock handling got a few correctness fixes alongside this: a bypass is now modeled as BypassNone/BypassRequested/BypassOverwrite rather than a single bool, because root's blanket ability to override a GOVERNANCE retention should only apply when the client actually asked to bypass it (DeleteObject/DeleteObjects/PutObjectRetention), not when the gateway is silently replacing a locked object via an overwrite, which needs the permission from everyone including root. Retention changes are now correctly classified as an extension (allowed under plain s3:PutObjectRetention) versus a weakening (date or mode change, which needs the bypass permission), and a COMPLIANCE lock can never be weakened by anyone regardless of permissions, matching AWS. Separately, VerifyObjectCopyAccess had a readonly-mode gap: it returned early for root/admin before ever calling VerifyAccess, so the readonly check inside VerifyAccess never ran for them on CopyObject; access checks are now ordered so the readonly gate always applies before any root/admin bypass, for copy as well as every other write path.

Bucket policies also gained Condition block support, via a new shared internal/condition package moved out of the IAM policy package since both bucket and identity policies share the same evaluation semantics. It implements the full AWS operator set — String{Equals,NotEquals,EqualsIgnoreCase,NotEqualsIgnoreCase,Like,NotLike}, Numeric{Equals,NotEquals,LessThan,LessThanEquals,GreaterThan,GreaterThanEquals}, Date{Equals,NotEquals,LessThan,LessThanEquals,GreaterThan,GreaterThanEquals}, Bool, BinaryEquals, Arn{Equals,Like,NotEquals,NotLike}, IpAddress/NotIpAddress, and Null — along with the ForAllValues/ForAnyValue set qualifiers and the IfExists modifier. A new requestConditionContext builds the per-request keys a bucket policy's Condition block can reference — aws:SourceIp, aws:SecureTransport, aws:CurrentTime, aws:EpochTime, aws:UserAgent, aws:Referer, s3:prefix, s3:delimiter, s3:max-keys, s3:x-amz-acl, s3:VersionId — following AWS's own per-action rules for which keys a given S3 operation actually populates. Identity-derived keys such as aws:PrincipalArn and aws:username are deliberately left unwired here, since the gateway has no way to know them; the standalone IAM service fills those in itself when it evaluates an identity policy.

Also added new integration test suites for S3-side IAM: s3_iam_access_control.go and s3_iam_session_access_control.go cover identity-policy enforcement and session-credential requests against real S3 operations, alongside expanded OIDC/web-identity coverage and a new runoidctests.sh runner wired into the OIDC GitHub Actions workflow.

cmd/internal/gwcli/iam.go

@@ -114,6 +114,31 @@ func IAMCommand() *cli.Command {
 				Usage:   "reject CreateOpenIDConnectProvider requests that omit ThumbprintList instead of auto-fetching it over an outbound TLS connection",
 				EnvVars: []string{"VGW_IAM_DISABLE_OIDC_THUMBPRINT_AUTOFETCH"},
 			},
+			&cli.StringSliceFlag{
+				Name:    "private-ports",
+				Usage:   "private endpoint listen address: a unix socket path, or <ip>:<port>/:<port> when mTLS (--private-cert/--private-cert-key/--private-client-ca) is also configured — refuses to start otherwise (can be specified multiple times)",
+				EnvVars: []string{"VGW_IAM_PRIVATE_PORTS"},
+			},
+			&cli.StringFlag{
+				Name:    "private-cert",
+				Usage:   "TLS server certificate for the private endpoint listener (required for a non-unix-socket --private-ports address)",
+				EnvVars: []string{"VGW_IAM_PRIVATE_CERT"},
+			},
+			&cli.StringFlag{
+				Name:    "private-cert-key",
+				Usage:   "TLS private key for --private-cert",
+				EnvVars: []string{"VGW_IAM_PRIVATE_CERT_KEY"},
+			},
+			&cli.StringFlag{
+				Name:    "private-client-ca",
+				Usage:   "PEM-encoded CA bundle used to verify the S3 gateway's client certificate on the private endpoint listener (required for a non-unix-socket --private-ports address, together with --private-cert/--private-cert-key)",
+				EnvVars: []string{"VGW_IAM_PRIVATE_CLIENT_CA"},
+			},
+			&cli.StringFlag{
+				Name:    "private-socket-perm",
+				Usage:   "octal file-mode permission for a file-backed unix-socket --private-ports address (e.g. '0660'); no effect on TCP or abstract-namespace sockets",
+				EnvVars: []string{"VGW_IAM_PRIVATE_SOCKET_PERM"},
+			},
 		},
 	}
 }

cmd/versitygw/iam.go

@@ -51,6 +51,11 @@ func runIAM(ctx *cli.Context) error {
 		KeepAlive:                      keepAlive,
 		HealthPath:                     healthPath,
 		SocketPerm:                     socketPerm,
+		PrivatePorts:                   ctx.StringSlice("private-ports"),
+		PrivateCertFile:                ctx.String("private-cert"),
+		PrivateKeyFile:                 ctx.String("private-cert-key"),
+		PrivateClientCAFile:            ctx.String("private-client-ca"),
+		PrivateSocketPerm:              ctx.String("private-socket-perm"),
 		IAMDir:                         ctx.String("dir"),
 		VaultEndpointURL:               ctx.String("vault-endpoint-url"),
 		VaultNamespace:                 ctx.String("vault-namespace"),

cmd/versitygw/main.go

@@ -27,77 +27,84 @@ import (
 	"github.com/versity/versitygw/cmd/internal/gwcli"
 	"github.com/versity/versitygw/debuglogger"
 	"github.com/versity/versitygw/embedgw"
-	"github.com/versity/versitygw/s3api/utils"
+	"github.com/versity/versitygw/internal/netutil"
 )
 
 var (
-	ports                                  []string
-	admPorts                               []string
-	region                                 string
-	maxConnections, maxRequests            int
-	adminMaxConnections, adminMaxRequests  int
-	corsAllowOrigin                        string
-	admCertFile, admKeyFile                string
-	certFile, keyFile                      string
-	kafkaURL, kafkaTopic, kafkaKey         string
-	natsURL, natsTopic                     string
-	rabbitmqURL, rabbitmqExchange          string
-	rabbitmqRoutingKey                     string
-	eventWebhookURL                        string
-	eventConfigFilePath                    string
-	logWebhookURL, accessLog               string
-	adminLogFile                           string
-	healthPath                             string
-	virtualDomain                          string
-	logLevel                               string
-	debug                                  bool
-	keepAlive                              bool
-	pprof                                  string
-	quiet                                  bool
-	readonly                               bool
-	iamDir                                 string
-	ldapURL, ldapBindDN, ldapPassword      string
-	ldapQueryBase, ldapObjClasses          string
-	ldapAccessAtr, ldapSecAtr, ldapRoleAtr string
-	ldapUserIdAtr, ldapGroupIdAtr          string
-	ldapProjectIdAtr                       string
-	ldapTLSSkipVerify                      bool
-	vaultEndpointURL, vaultNamespace       string
-	vaultSecretStoragePath                 string
-	vaultSecretStorageNamespace            string
-	vaultAuthMethod, vaultAuthNamespace    string
-	vaultMountPath                         string
-	vaultRootToken, vaultRoleId            string
-	vaultRoleSecret, vaultServerCert       string
-	vaultClientCert, vaultClientCertKey    string
-	s3IamAccess, s3IamSecret               string
-	s3IamRegion, s3IamBucket               string
-	s3IamEndpoint                          string
-	s3IamSslNoVerify                       bool
-	iamCacheDisable                        bool
-	iamCacheTTL                            int
-	iamCachePrune                          int
-	metricsService                         string
-	statsdServers                          string
-	dogstatsServers                        string
-	ipaHost, ipaVaultName                  string
-	ipaUser, ipaPassword                   string
-	ipaInsecure                            bool
-	iamDebug                               bool
-	webuiPorts                             []string
-	webuiCertFile, webuiKeyFile            string
-	webuiNoTLS                             bool
-	webuiGateways                          []string
-	webuiAdminGateways                     []string
-	webuiPathPrefix                        string
-	webuiS3Prefix                          string
-	websitePorts                           []string
-	websiteDomain                          string
-	websiteCertFile, websiteKeyFile        string
-	websiteNoTLS                           bool
-	disableACLs                            bool
-	mpMaxParts                             int
-	socketPerm                             string
+	ports                                         []string
+	admPorts                                      []string
+	region                                        string
+	maxConnections, maxRequests                   int
+	adminMaxConnections, adminMaxRequests         int
+	corsAllowOrigin                               string
+	admCertFile, admKeyFile                       string
+	certFile, keyFile                             string
+	kafkaURL, kafkaTopic, kafkaKey                string
+	natsURL, natsTopic                            string
+	rabbitmqURL, rabbitmqExchange                 string
+	rabbitmqRoutingKey                            string
+	eventWebhookURL                               string
+	eventConfigFilePath                           string
+	logWebhookURL, accessLog                      string
+	adminLogFile                                  string
+	healthPath                                    string
+	virtualDomain                                 string
+	logLevel                                      string
+	debug                                         bool
+	keepAlive                                     bool
+	pprof                                         string
+	quiet                                         bool
+	readonly                                      bool
+	iamDir                                        string
+	ldapURL, ldapBindDN, ldapPassword             string
+	ldapQueryBase, ldapObjClasses                 string
+	ldapAccessAtr, ldapSecAtr, ldapRoleAtr        string
+	ldapUserIdAtr, ldapGroupIdAtr                 string
+	ldapProjectIdAtr                              string
+	ldapTLSSkipVerify                             bool
+	vaultEndpointURL, vaultNamespace              string
+	vaultSecretStoragePath                        string
+	vaultSecretStorageNamespace                   string
+	vaultAuthMethod, vaultAuthNamespace           string
+	vaultMountPath                                string
+	vaultRootToken, vaultRoleId                   string
+	vaultRoleSecret, vaultServerCert              string
+	vaultClientCert, vaultClientCertKey           string
+	s3IamAccess, s3IamSecret                      string
+	s3IamRegion, s3IamBucket                      string
+	s3IamEndpoint                                 string
+	s3IamSslNoVerify                              bool
+	iamCacheDisable                               bool
+	iamCacheTTL                                   int
+	iamCachePrune                                 int
+	metricsService                                string
+	statsdServers                                 string
+	dogstatsServers                               string
+	ipaHost, ipaVaultName                         string
+	ipaUser, ipaPassword                          string
+	ipaInsecure                                   bool
+	standaloneIAMEndpoint                         string
+	standaloneIAMAccess, standaloneIAMSecret      string
+	standaloneClientCert, standaloneClientCertKey string
+	standaloneServerCA                            string
+	standaloneDefaultUserID                       int
+	standaloneDefaultGroupID                      int
+	standaloneDefaultProjectID                    int
+	iamDebug                                      bool
+	webuiPorts                                    []string
+	webuiCertFile, webuiKeyFile                   string
+	webuiNoTLS                                    bool
+	webuiGateways                                 []string
+	webuiAdminGateways                            []string
+	webuiPathPrefix                               string
+	webuiS3Prefix                                 string
+	websitePorts                                  []string
+	websiteDomain                                 string
+	websiteCertFile, websiteKeyFile               string
+	websiteNoTLS                                  bool
+	disableACLs                                   bool
+	mpMaxParts                                    int
+	socketPerm                                    string
 )
 
 var (
@@ -163,16 +170,16 @@ documentation can be found in the GitHub wiki.`,
 			// Resolve relative UNIX socket paths to absolute before any backend
 			// (e.g. posix) can change the working directory via os.Chdir.
 			var err error
-			if ports, err = utils.AbsSocketPaths(ports); err != nil {
+			if ports, err = netutil.AbsSocketPaths(ports); err != nil {
 				return err
 			}
-			if admPorts, err = utils.AbsSocketPaths(admPorts); err != nil {
+			if admPorts, err = netutil.AbsSocketPaths(admPorts); err != nil {
 				return err
 			}
-			if webuiPorts, err = utils.AbsSocketPaths(webuiPorts); err != nil {
+			if webuiPorts, err = netutil.AbsSocketPaths(webuiPorts); err != nil {
 				return err
 			}
-			if websitePorts, err = utils.AbsSocketPaths(websitePorts); err != nil {
+			if websitePorts, err = netutil.AbsSocketPaths(websitePorts); err != nil {
 				return err
 			}
 			return nil
@@ -797,6 +804,60 @@ func initFlags() []cli.Flag {
 			EnvVars:     []string{"VGW_IPA_INSECURE"},
 			Destination: &ipaInsecure,
 		},
+		&cli.StringFlag{
+			Name:        "iam-standalone-endpoint",
+			Usage:       "standalone IAM service private-endpoint address: a unix socket path, or <host>:<port> when mTLS (--iam-standalone-client-cert/-key/--iam-standalone-server-ca) is also configured",
+			EnvVars:     []string{"VGW_IAM_STANDALONE_ENDPOINT"},
+			Destination: &standaloneIAMEndpoint,
+		},
+		&cli.StringFlag{
+			Name:        "iam-standalone-access",
+			Usage:       "access key this gateway signs its own calls to the standalone IAM service with (defaults to --access/root)",
+			EnvVars:     []string{"VGW_IAM_STANDALONE_ACCESS"},
+			Destination: &standaloneIAMAccess,
+		},
+		&cli.StringFlag{
+			Name:        "iam-standalone-secret",
+			Usage:       "secret key this gateway signs its own calls to the standalone IAM service with (defaults to --secret/root)",
+			EnvVars:     []string{"VGW_IAM_STANDALONE_SECRET"},
+			Destination: &standaloneIAMSecret,
+		},
+		&cli.StringFlag{
+			Name:        "iam-standalone-client-cert",
+			Usage:       "client TLS certificate this gateway presents to the standalone IAM service (required for a non-unix-socket --iam-standalone-endpoint)",
+			EnvVars:     []string{"VGW_IAM_STANDALONE_CLIENT_CERT"},
+			Destination: &standaloneClientCert,
+		},
+		&cli.StringFlag{
+			Name:        "iam-standalone-client-cert-key",
+			Usage:       "private key for --iam-standalone-client-cert",
+			EnvVars:     []string{"VGW_IAM_STANDALONE_CLIENT_CERT_KEY"},
+			Destination: &standaloneClientCertKey,
+		},
+		&cli.StringFlag{
+			Name:        "iam-standalone-server-ca",
+			Usage:       "PEM-encoded CA bundle used to verify the standalone IAM service's server certificate (required for a non-unix-socket --iam-standalone-endpoint)",
+			EnvVars:     []string{"VGW_IAM_STANDALONE_SERVER_CA"},
+			Destination: &standaloneServerCA,
+		},
+		&cli.IntFlag{
+			Name:        "iam-standalone-default-uid",
+			Usage:       "POSIX uid assigned to every account resolved through the standalone IAM backend (it has no per-user POSIX identity of its own)",
+			EnvVars:     []string{"VGW_IAM_STANDALONE_DEFAULT_UID"},
+			Destination: &standaloneDefaultUserID,
+		},
+		&cli.IntFlag{
+			Name:        "iam-standalone-default-gid",
+			Usage:       "POSIX gid assigned to every account resolved through the standalone IAM backend",
+			EnvVars:     []string{"VGW_IAM_STANDALONE_DEFAULT_GID"},
+			Destination: &standaloneDefaultGroupID,
+		},
+		&cli.IntFlag{
+			Name:        "iam-standalone-default-project-id",
+			Usage:       "project id assigned to every account resolved through the standalone IAM backend",
+			EnvVars:     []string{"VGW_IAM_STANDALONE_DEFAULT_PROJECT_ID"},
+			Destination: &standaloneDefaultProjectID,
+		},
 		&cli.IntFlag{
 			Name:        "mp-max-parts",
 			Usage:       "maximum number of parts allowed in a multipart upload",
@@ -920,6 +981,15 @@ func runGateway(ctx context.Context, be backend.Backend) error {
 		IpaUser:                     ipaUser,
 		IpaPassword:                 ipaPassword,
 		IpaInsecure:                 ipaInsecure,
+		StandaloneIAMEndpoint:       standaloneIAMEndpoint,
+		StandaloneIAMAccess:         standaloneIAMAccess,
+		StandaloneIAMSecret:         standaloneIAMSecret,
+		StandaloneClientCert:        standaloneClientCert,
+		StandaloneClientCertKey:     standaloneClientCertKey,
+		StandaloneServerCA:          standaloneServerCA,
+		StandaloneDefaultUserID:     standaloneDefaultUserID,
+		StandaloneDefaultGroupID:    standaloneDefaultGroupID,
+		StandaloneDefaultProjectID:  standaloneDefaultProjectID,
 		AccessLog:                   accessLog,
 		LogWebhookURL:               logWebhookURL,
 		AdminLogFile:                adminLogFile,

cmd/versitygw/test.go

@@ -26,6 +26,7 @@ var (
 	awsID             string
 	awsSecret         string
 	endpoint          string
+	iamEndpoint       string
 	websiteSchemeTest string
 	websiteDomainTest string
 	websitePortTest   string
@@ -82,6 +83,12 @@ func initTestFlags() []cli.Flag {
 			Destination: &endpoint,
 			Aliases:     []string{"e"},
 		},
+		&cli.StringFlag{
+			Name:        "iam-endpoint",
+			Usage:       "standalone IAM/STS service endpoint, when it is a separate process from the s3 endpoint (defaults to --endpoint)",
+			Destination: &iamEndpoint,
+			Aliases:     []string{"ie"},
+		},
 		&cli.BoolFlag{
 			Name:        "host-style",
 			Usage:       "Use host-style bucket addressing",
@@ -212,6 +219,24 @@ func initTestCommands() []*cli.Command {
 			Usage:  "Tests gateway access control with bucket ACLs and Policies",
 			Action: getAction(integration.TestAccessControl),
 		},
+		{
+			Name:  "s3-iam",
+			Usage: "Tests s3 gateway access control backed by the standalone IAM service",
+			Description: `Runs the access-control tests for an s3 gateway configured with --iam-standalone-endpoint:
+			IAM user identity policies, their interaction with bucket policies, governance-retention
+			bypass, and bucket creation. Requires --iam-endpoint pointing at the IAM service's
+			control-plane API, since the tests create the users and policies they then exercise.`,
+			Action: getAction(integration.TestS3IAMAccessControl),
+		},
+		{
+			Name:  "s3-iam-session",
+			Usage: "Tests s3 gateway access control for assumed-role session credentials",
+			Description: `Runs the role/session access-control tests against an s3 gateway backed by the
+			standalone IAM service. Every test mints real temporary credentials via
+			AssumeRoleWithWebIdentity against GitHub Actions' OIDC issuer, so the whole group skips
+			itself outside a GitHub Actions job holding id-token: write permission.`,
+			Action: getAction(integration.TestS3IAMSessionAccessControl),
+		},
 		{
 			Name:   "noacl",
 			Usage:  "Tests gateway in ACL-disabled mode",
@@ -434,6 +459,7 @@ func getAction(tf testFunc) func(ctx *cli.Context) error {
 			integration.WithSecret(awsSecret),
 			integration.WithRegion(region),
 			integration.WithEndpoint(endpoint),
+			integration.WithIAMEndpoint(iamEndpoint),
 			integration.WithTLSStatus(tlsStatus),
 		}
 		if testDebug {
@@ -484,6 +510,7 @@ func extractIntTests() (commands []*cli.Command) {
 					integration.WithSecret(awsSecret),
 					integration.WithRegion(region),
 					integration.WithEndpoint(endpoint),
+					integration.WithIAMEndpoint(iamEndpoint),
 					integration.WithTLSStatus(tlsStatus),
 				}
 				if testDebug {

cmd/vgwrdma/main.go

@@ -31,9 +31,9 @@ import (
 	"github.com/versity/versitygw/cumiddleware"
 	"github.com/versity/versitygw/debuglogger"
 	"github.com/versity/versitygw/embedgw"
+	"github.com/versity/versitygw/internal/netutil"
 	"github.com/versity/versitygw/rdma"
 	"github.com/versity/versitygw/s3api"
-	"github.com/versity/versitygw/s3api/utils"
 )
 
 var (
@@ -184,16 +184,16 @@ documentation can be found in the GitHub wiki.`,
 			// Resolve relative UNIX socket paths to absolute before any backend
 			// (e.g. posix) can change the working directory via os.Chdir.
 			var err error
-			if ports, err = utils.AbsSocketPaths(ports); err != nil {
+			if ports, err = netutil.AbsSocketPaths(ports); err != nil {
 				return err
 			}
-			if admPorts, err = utils.AbsSocketPaths(admPorts); err != nil {
+			if admPorts, err = netutil.AbsSocketPaths(admPorts); err != nil {
 				return err
 			}
-			if webuiPorts, err = utils.AbsSocketPaths(webuiPorts); err != nil {
+			if webuiPorts, err = netutil.AbsSocketPaths(webuiPorts); err != nil {
 				return err
 			}
-			if websitePorts, err = utils.AbsSocketPaths(websitePorts); err != nil {
+			if websitePorts, err = netutil.AbsSocketPaths(websitePorts); err != nil {
 				return err
 			}