mirror of
https://github.com/versity/versitygw.git
synced 2026-09-28 18:55:54 +00:00
feat: add IAM OIDC provider tagging actions
Adds `TagOpenIDConnectProvider`, `UntagOpenIDConnectProvider` and `ListOpenIDConnectProviderTags` to the standalone IAM service, backed by both the internal and Vault storers. They follow the user and role tagging actions in most respects — the tag action merges into the provider's existing tags and rejects a repeated key, untag removal is idempotent, and the tag listing is sorted by key and paginated, with the per-request member count and the per-provider tag total enforced as separate quotas so replacing a tag on a provider already at the 50-tag cap still succeeds — but differ in the one respect IAM itself draws: OIDC provider tag keys are compared exactly, not case-insensitively. On a provider `env` and `ENV` are two independent tags, both may be supplied in a single request, only a byte-identical repeat is a duplicate (reported without the "Tag keys are case insensitive" note the user and role actions carry), and untagging `env` leaves `ENV` in place. That distinction is now carried by `iamutil.TagKeyCase`, which `ParseTags` uses for duplicate detection and which `mergeTags`, `removeTags` and the tag listing's marker lookup use for key matching. `CreateOpenIDConnectProvider` moves onto the exact comparison too, so a provider created with case-differing tag keys keeps both. All three actions are authorized against the target provider's ARN, so `aws:ResourceTag/<key>` reads the provider's own tags, and the tag and untag actions populate `aws:RequestTag/<key>` and `aws:TagKeys` respectively, so a tag-scoped policy Condition governs which tags a caller may set or remove. All three report a missing provider with the wording `DeleteOpenIDConnectProvider` uses rather than the one `GetOpenIDConnectProvider` uses, which is why the Vault provider read now takes the not-found error its calling action reports. The WebGUI gains a Tags section in the OIDC provider manage view, replacing the read-only tag row, and the shared tag editor gains a case-sensitive mode that changes its duplicate-key check, its diffing of an edited set into an untag and tag pair, and the wording of its guidance.
This commit is contained in:
niksis02
@@ -1551,6 +1551,47 @@ func TestIAMUpdateOpenIDConnectProviderThumbprint(ts *TestState) {
|
||||
ts.Run(IAMUpdateOpenIDConnectProviderThumbprint_boundary_max_thumbprints)
|
||||
}
|
||||
|
||||
func TestIAMTagOpenIDConnectProvider(ts *TestState) {
|
||||
ts.Run(IAMTagOpenIDConnectProvider_missing_arn)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_invalid_arn)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_missing_tags)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_missing_tag_key)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_missing_tag_value)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_invalid_tags)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_duplicate_tag_keys)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_too_many_tags)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_non_existing_provider)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_invalid_tags_precede_lookup)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_tag_limit_exceeded)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_success)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_overwrites_existing_tag)
|
||||
ts.Run(IAMTagOpenIDConnectProvider_isolated_per_provider)
|
||||
}
|
||||
|
||||
func TestIAMUntagOpenIDConnectProvider(ts *TestState) {
|
||||
ts.Run(IAMUntagOpenIDConnectProvider_missing_arn)
|
||||
ts.Run(IAMUntagOpenIDConnectProvider_invalid_arn)
|
||||
ts.Run(IAMUntagOpenIDConnectProvider_missing_tag_keys)
|
||||
ts.Run(IAMUntagOpenIDConnectProvider_invalid_tag_key)
|
||||
ts.Run(IAMUntagOpenIDConnectProvider_too_many_tag_keys)
|
||||
ts.Run(IAMUntagOpenIDConnectProvider_non_existing_provider)
|
||||
ts.Run(IAMUntagOpenIDConnectProvider_success)
|
||||
ts.Run(IAMUntagOpenIDConnectProvider_removal_is_idempotent)
|
||||
ts.Run(IAMUntagOpenIDConnectProvider_case_sensitive_key)
|
||||
ts.Run(IAMUntagOpenIDConnectProvider_removes_only_named_keys)
|
||||
}
|
||||
|
||||
func TestIAMListOpenIDConnectProviderTags(ts *TestState) {
|
||||
ts.Run(IAMListOpenIDConnectProviderTags_missing_arn)
|
||||
ts.Run(IAMListOpenIDConnectProviderTags_invalid_arn)
|
||||
ts.Run(IAMListOpenIDConnectProviderTags_invalid_max_items)
|
||||
ts.Run(IAMListOpenIDConnectProviderTags_invalid_max_items_format)
|
||||
ts.Run(IAMListOpenIDConnectProviderTags_non_existing_provider)
|
||||
ts.Run(IAMListOpenIDConnectProviderTags_empty_result)
|
||||
ts.Run(IAMListOpenIDConnectProviderTags_success)
|
||||
ts.Run(IAMListOpenIDConnectProviderTags_pagination)
|
||||
}
|
||||
|
||||
func TestIAMAssumeRoleWithWebIdentity(ts *TestState) {
|
||||
ts.Run(IAMAssumeRoleWithWebIdentity_missing_role_arn)
|
||||
ts.Run(IAMAssumeRoleWithWebIdentity_role_arn_too_short)
|
||||
@@ -1756,6 +1797,9 @@ func TestIAM(ts *TestState) {
|
||||
TestIAMAddClientIDToOpenIDConnectProvider(ts)
|
||||
TestIAMRemoveClientIDFromOpenIDConnectProvider(ts)
|
||||
TestIAMUpdateOpenIDConnectProviderThumbprint(ts)
|
||||
TestIAMTagOpenIDConnectProvider(ts)
|
||||
TestIAMUntagOpenIDConnectProvider(ts)
|
||||
TestIAMListOpenIDConnectProviderTags(ts)
|
||||
TestIAMAssumeRoleWithWebIdentity(ts)
|
||||
TestIAMGetCallerIdentity(ts)
|
||||
TestIAMAccessControl(ts)
|
||||
@@ -2487,6 +2531,38 @@ func GetIntTests() IntTests {
|
||||
"IAMUpdateOpenIDConnectProviderThumbprint_non_existing_provider": IAMUpdateOpenIDConnectProviderThumbprint_non_existing_provider,
|
||||
"IAMUpdateOpenIDConnectProviderThumbprint_success": IAMUpdateOpenIDConnectProviderThumbprint_success,
|
||||
"IAMUpdateOpenIDConnectProviderThumbprint_boundary_max_thumbprints": IAMUpdateOpenIDConnectProviderThumbprint_boundary_max_thumbprints,
|
||||
"IAMTagOpenIDConnectProvider_missing_arn": IAMTagOpenIDConnectProvider_missing_arn,
|
||||
"IAMTagOpenIDConnectProvider_invalid_arn": IAMTagOpenIDConnectProvider_invalid_arn,
|
||||
"IAMTagOpenIDConnectProvider_missing_tags": IAMTagOpenIDConnectProvider_missing_tags,
|
||||
"IAMTagOpenIDConnectProvider_missing_tag_key": IAMTagOpenIDConnectProvider_missing_tag_key,
|
||||
"IAMTagOpenIDConnectProvider_missing_tag_value": IAMTagOpenIDConnectProvider_missing_tag_value,
|
||||
"IAMTagOpenIDConnectProvider_invalid_tags": IAMTagOpenIDConnectProvider_invalid_tags,
|
||||
"IAMTagOpenIDConnectProvider_duplicate_tag_keys": IAMTagOpenIDConnectProvider_duplicate_tag_keys,
|
||||
"IAMTagOpenIDConnectProvider_too_many_tags": IAMTagOpenIDConnectProvider_too_many_tags,
|
||||
"IAMTagOpenIDConnectProvider_non_existing_provider": IAMTagOpenIDConnectProvider_non_existing_provider,
|
||||
"IAMTagOpenIDConnectProvider_invalid_tags_precede_lookup": IAMTagOpenIDConnectProvider_invalid_tags_precede_lookup,
|
||||
"IAMTagOpenIDConnectProvider_tag_limit_exceeded": IAMTagOpenIDConnectProvider_tag_limit_exceeded,
|
||||
"IAMTagOpenIDConnectProvider_success": IAMTagOpenIDConnectProvider_success,
|
||||
"IAMTagOpenIDConnectProvider_overwrites_existing_tag": IAMTagOpenIDConnectProvider_overwrites_existing_tag,
|
||||
"IAMTagOpenIDConnectProvider_isolated_per_provider": IAMTagOpenIDConnectProvider_isolated_per_provider,
|
||||
"IAMUntagOpenIDConnectProvider_missing_arn": IAMUntagOpenIDConnectProvider_missing_arn,
|
||||
"IAMUntagOpenIDConnectProvider_invalid_arn": IAMUntagOpenIDConnectProvider_invalid_arn,
|
||||
"IAMUntagOpenIDConnectProvider_missing_tag_keys": IAMUntagOpenIDConnectProvider_missing_tag_keys,
|
||||
"IAMUntagOpenIDConnectProvider_invalid_tag_key": IAMUntagOpenIDConnectProvider_invalid_tag_key,
|
||||
"IAMUntagOpenIDConnectProvider_too_many_tag_keys": IAMUntagOpenIDConnectProvider_too_many_tag_keys,
|
||||
"IAMUntagOpenIDConnectProvider_non_existing_provider": IAMUntagOpenIDConnectProvider_non_existing_provider,
|
||||
"IAMUntagOpenIDConnectProvider_success": IAMUntagOpenIDConnectProvider_success,
|
||||
"IAMUntagOpenIDConnectProvider_removal_is_idempotent": IAMUntagOpenIDConnectProvider_removal_is_idempotent,
|
||||
"IAMUntagOpenIDConnectProvider_case_sensitive_key": IAMUntagOpenIDConnectProvider_case_sensitive_key,
|
||||
"IAMUntagOpenIDConnectProvider_removes_only_named_keys": IAMUntagOpenIDConnectProvider_removes_only_named_keys,
|
||||
"IAMListOpenIDConnectProviderTags_missing_arn": IAMListOpenIDConnectProviderTags_missing_arn,
|
||||
"IAMListOpenIDConnectProviderTags_invalid_arn": IAMListOpenIDConnectProviderTags_invalid_arn,
|
||||
"IAMListOpenIDConnectProviderTags_invalid_max_items": IAMListOpenIDConnectProviderTags_invalid_max_items,
|
||||
"IAMListOpenIDConnectProviderTags_invalid_max_items_format": IAMListOpenIDConnectProviderTags_invalid_max_items_format,
|
||||
"IAMListOpenIDConnectProviderTags_non_existing_provider": IAMListOpenIDConnectProviderTags_non_existing_provider,
|
||||
"IAMListOpenIDConnectProviderTags_empty_result": IAMListOpenIDConnectProviderTags_empty_result,
|
||||
"IAMListOpenIDConnectProviderTags_success": IAMListOpenIDConnectProviderTags_success,
|
||||
"IAMListOpenIDConnectProviderTags_pagination": IAMListOpenIDConnectProviderTags_pagination,
|
||||
"IAMAssumeRoleWithWebIdentity_missing_role_arn": IAMAssumeRoleWithWebIdentity_missing_role_arn,
|
||||
"IAMAssumeRoleWithWebIdentity_role_arn_too_short": IAMAssumeRoleWithWebIdentity_role_arn_too_short,
|
||||
"IAMAssumeRoleWithWebIdentity_malformed_duration": IAMAssumeRoleWithWebIdentity_malformed_duration,
|
||||
|
||||
Reference in New Issue
Block a user