feat: add IAM OIDC provider tagging actions

Adds `TagOpenIDConnectProvider`, `UntagOpenIDConnectProvider` and `ListOpenIDConnectProviderTags` to the standalone IAM service, backed by both the internal and Vault storers. They follow the user and role tagging actions in most respects — the tag action merges into the provider's existing tags and rejects a repeated key, untag removal is idempotent, and the tag listing is sorted by key and paginated, with the per-request member count and the per-provider tag total enforced as separate quotas so replacing a tag on a provider already at the 50-tag cap still succeeds — but differ in the one respect IAM itself draws: OIDC provider tag keys are compared exactly, not case-insensitively. On a provider `env` and `ENV` are two independent tags, both may be supplied in a single request, only a byte-identical repeat is a duplicate (reported without the "Tag keys are case insensitive" note the user and role actions carry), and untagging `env` leaves `ENV` in place. That distinction is now carried by `iamutil.TagKeyCase`, which `ParseTags` uses for duplicate detection and which `mergeTags`, `removeTags` and the tag listing's marker lookup use for key matching. `CreateOpenIDConnectProvider` moves onto the exact comparison too, so a provider created with case-differing tag keys keeps both. All three actions are authorized against the target provider's ARN, so `aws:ResourceTag/<key>` reads the provider's own tags, and the tag and untag actions populate `aws:RequestTag/<key>` and `aws:TagKeys` respectively, so a tag-scoped policy Condition governs which tags a caller may set or remove. All three report a missing provider with the wording `DeleteOpenIDConnectProvider` uses rather than the one `GetOpenIDConnectProvider` uses, which is why the Vault provider read now takes the not-found error its calling action reports. The WebGUI gains a Tags section in the OIDC provider manage view, replacing the read-only tag row, and the shared tag editor gains a case-sensitive mode that changes its duplicate-key check, its diffing of an edited set into an untag and tag pair, and the wording of its guidance.
2026-09-24 17:04:16 +00:00 · 2026-08-28 00:49:21 +04:00
parent 1bbcd64195
commit 4901afe27b
19 changed files with 2086 additions and 94 deletions
@@ -219,7 +219,7 @@ under the License.
                <button type="button" onclick="iamAddTagRow('create-provider-tags')" class="px-3 py-1.5 text-xs border border-gray-200 hover:bg-gray-50 text-charcoal rounded-lg transition-colors">Add Tag</button>
              </div>
              <div id="create-provider-tags" class="space-y-2"></div>
-              <p class="mt-2 text-xs text-charcoal-300">Tags are set at creation only.</p>
+              <p class="mt-2 text-xs text-charcoal-300">Optional. Tags can also be added, changed and removed later from the provider’s Manage view.</p>
            </div>
          </form>
        </div>
@@ -239,7 +239,7 @@ under the License.
        <div class="flex items-center justify-between p-6 border-b border-gray-100 flex-shrink-0">
          <div>
            <h2 id="manage-provider-title" class="text-xl font-semibold text-charcoal">Provider</h2>
-            <p class="text-sm text-charcoal-300 mt-1">URL and tags are fixed at creation. Client IDs change one at a time; thumbprints are replaced as a whole list.</p>
+            <p class="text-sm text-charcoal-300 mt-1">The URL is fixed at creation. Client IDs change one at a time; thumbprints are replaced as a whole list.</p>
          </div>
          <button onclick="closeModal('manage-provider-modal')" class="p-2 text-charcoal-300 hover:text-charcoal hover:bg-gray-100 rounded-lg transition-colors">
            <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
@@ -263,13 +263,21 @@ under the License.
                  <dt class="text-charcoal-300">Created</dt>
                  <dd id="provider-detail-created" class="mt-1 text-charcoal">-</dd>
                </div>
-                <div class="sm:col-span-2">
-                  <dt class="text-charcoal-300">Tags</dt>
-                  <dd id="provider-detail-tags" class="mt-1 flex flex-wrap gap-2">-</dd>
-                </div>
              </dl>
            </div>

+            <!-- Tags -->
+            <div>
+              <div class="flex items-center justify-between mb-3">
+                <div>
+                  <h3 class="text-sm font-semibold text-charcoal">Tags</h3>
+                  <p id="provider-tag-quota-note" class="text-xs text-charcoal-300 mt-1">Key/value labels, also readable from policy conditions.</p>
+                </div>
+                <button id="edit-provider-tags-btn" onclick="openProviderTagEditor()" class="px-3 py-1.5 text-xs border border-accent text-accent hover:bg-accent-50 font-medium rounded-lg transition-colors">Edit Tags</button>
+              </div>
+              <div id="provider-tags" class="border border-gray-100 rounded-lg p-4 flex flex-wrap gap-2"></div>
+            </div>
+
            <!-- Client IDs -->
            <div>
              <h3 class="text-sm font-semibold text-charcoal mb-1">Audiences / Client IDs</h3>
@@ -360,6 +368,7 @@ under the License.
  <script>
    let allProviders = [];       // ARNs
    let currentProvider = null;  // { arn, url, clientIDList, thumbprintList, createDate, tags }
+    let currentProviderTags = [];    // the open provider's tags, as [{Key, Value}]
    let providerToDelete = null;

    if (!requireIAM()) {
@@ -506,14 +515,15 @@ under the License.

    async function openManageProviderModal(arn) {
      currentProvider = { arn };
+      currentProviderTags = [];
      document.getElementById('manage-provider-title').textContent = providerNameFromArn(arn);
      document.getElementById('provider-detail-arn').innerHTML = iamArnCell(arn);
      document.getElementById('provider-detail-url').textContent = 'Loading...';
      document.getElementById('provider-detail-created').textContent = '-';
-      document.getElementById('provider-detail-tags').innerHTML = '<span class="text-charcoal-300">-</span>';
      document.getElementById('provider-clients').innerHTML = '';
      document.getElementById('provider-thumbprints').innerHTML = '';
      openModal('manage-provider-modal');
+      loadProviderTags();
      await loadProviderDetail();
    }

@@ -524,11 +534,6 @@ under the License.
        document.getElementById('provider-detail-url').textContent = detail.url || '-';
        document.getElementById('provider-detail-created').textContent = iamFormatDate(detail.createDate);

-        const tagsEl = document.getElementById('provider-detail-tags');
-        tagsEl.innerHTML = detail.tags.length === 0
-          ? '<span class="text-charcoal-300">-</span>'
-          : detail.tags.map(tag => `<span class="px-2 py-0.5 bg-gray-100 text-charcoal text-xs font-mono rounded">${escapeHtml(tag.Key)}=${escapeHtml(tag.Value || '')}</span>`).join('');
-
        renderClientIds(detail.clientIDList);
        renderThumbprints(detail.thumbprintList);
      } catch (error) {
@@ -540,6 +545,70 @@ under the License.
      }
    }

+    // ============================================
+    // Manage: tags
+    // ============================================
+
+    /**
+     * ListOpenIDConnectProviderTags is its own permission, so this loads the
+     * tags rather than reusing whatever GetOpenIDConnectProvider happened to
+     * return — and a denial disables editing in place instead of failing the
+     * whole modal.
+     */
+    async function loadProviderTags() {
+      const el = document.getElementById('provider-tags');
+      el.innerHTML = '<span class="text-sm text-charcoal-300">Loading...</span>';
+      try {
+        currentProviderTags = [];
+        let marker = null;
+        do {
+          const page = await api.iamListOIDCProviderTags(currentProvider.arn, { marker: marker || undefined });
+          currentProviderTags = currentProviderTags.concat(page.tags);
+          marker = page.isTruncated ? page.marker : null;
+        } while (marker);
+
+        el.innerHTML = iamTagChips(currentProviderTags);
+        setEditProviderTagsEnabled(true);
+        updateProviderTagQuotaNote();
+      } catch (error) {
+        console.error('Error loading tags:', error);
+        setEditProviderTagsEnabled(false);
+        el.innerHTML = iamIsAccessDenied(error)
+          ? '<span class="text-sm text-charcoal-300">You don\u2019t have permission to list this provider\u2019s tags</span>'
+          : `<span class="text-sm text-charcoal-300">Error loading tags: ${escapeHtml(iamShortError(error))}</span>`;
+      }
+    }
+
+    function setEditProviderTagsEnabled(enabled) {
+      const button = document.getElementById('edit-provider-tags-btn');
+      button.disabled = !enabled;
+      button.className = enabled
+        ? 'px-3 py-1.5 text-xs border border-accent text-accent hover:bg-accent-50 font-medium rounded-lg transition-colors'
+        : 'px-3 py-1.5 text-xs border border-gray-200 text-charcoal-300 rounded-lg opacity-50 cursor-not-allowed';
+    }
+
+    function updateProviderTagQuotaNote() {
+      document.getElementById('provider-tag-quota-note').textContent =
+        `${currentProviderTags.length} / ${IAM_LIMITS.tagsPerResource} tags. Keys are case sensitive.`;
+    }
+
+    function openProviderTagEditor() {
+      iamTagEditor.open({
+        title: 'Edit Tags',
+        subtitle: `Provider ${providerNameFromArn(currentProvider.arn)}`,
+        tags: currentProviderTags,
+        caseSensitiveKeys: true,
+        onSave: async ({ set, remove }) => {
+          // Removals first: they free room under the 50-tag cap for whatever
+          // this same edit is adding.
+          if (remove.length) await api.iamUntagOIDCProvider(currentProvider.arn, remove);
+          if (set.length) await api.iamTagOIDCProvider(currentProvider.arn, set);
+          showToast('Tags updated successfully', 'success');
+          loadProviderTags();
+        }
+      });
+    }
+
    function renderClientIds(clients) {
      const el = document.getElementById('provider-clients');
      if (!clients || clients.length === 0) {
@@ -2758,6 +2758,38 @@ ${tagsXml}
    await this.iamRequest('UpdateOpenIDConnectProviderThumbprint', params);
  }

+  // ---- OIDC provider tags ----
+
+  /**
+   * Add or replace tags on an OIDC provider. A key already present is
+   * overwritten rather than duplicated, so this doubles as the edit path.
+   * Provider tag keys are compared exactly, so a key differing only in case
+   * is a separate tag.
+   */
+  async iamTagOIDCProvider(arn, tags) {
+    const params = { OpenIDConnectProviderArn: arn };
+    this.flattenTags(params, tags);
+    await this.iamRequest('TagOpenIDConnectProvider', params);
+  }
+
+  async iamUntagOIDCProvider(arn, tagKeys) {
+    const params = { OpenIDConnectProviderArn: arn };
+    this.flattenMemberList(params, 'TagKeys', tagKeys);
+    await this.iamRequest('UntagOpenIDConnectProvider', params);
+  }
+
+  async iamListOIDCProviderTags(arn, options = {}) {
+    const params = { OpenIDConnectProviderArn: arn };
+    if (options.marker) params.Marker = options.marker;
+    if (options.maxItems) params.MaxItems = options.maxItems;
+    const result = await this.iamRequest('ListOpenIDConnectProviderTags', params);
+    return {
+      tags: iamAsArray(result.Tags),
+      isTruncated: result.IsTruncated === 'true',
+      marker: result.Marker || null
+    };
+  }
+
  // ---- Self identity (STS) ----

  /**
@@ -168,10 +168,12 @@ function iamValidatePath(path) {

 /**
 * Validate a collected tag list against the same rules the server applies,
- * so an obvious mistake is caught before a round trip. Returns an error
- * string, or null when the list is acceptable.
+ * so an obvious mistake is caught before a round trip. caseSensitiveKeys
+ * selects the resource's key-comparison rule: users and roles fold key
+ * case, OIDC providers compare keys exactly. Returns an error string, or
+ * null when the list is acceptable.
 */
-function iamValidateTags(tags) {
+function iamValidateTags(tags, caseSensitiveKeys = false) {
  if (tags.length > IAM_LIMITS.tagsPerResource) {
    return `A single resource can carry ${IAM_LIMITS.tagsPerResource} tags at most.`;
  }
@@ -191,11 +193,13 @@ function iamValidateTags(tags) {
    if (!IAM_LIMITS.tagValuePattern.test(tag.Value || '')) {
      return `Tag value for "${tag.Key}" may contain letters, numbers, spaces and _ . : / = + - @ only.`;
    }
-    // Tag keys are compared case-insensitively, so "env" and "ENV" are the
-    // same key twice — which the service rejects outright.
-    const folded = tag.Key.toLowerCase();
-    if (seen.has(folded)) return `Tag key "${tag.Key}" is listed twice. Keys are case insensitive.`;
-    seen.add(folded);
+    const normalized = caseSensitiveKeys ? tag.Key : tag.Key.toLowerCase();
+    if (seen.has(normalized)) {
+      return caseSensitiveKeys
+        ? `Tag key "${tag.Key}" is listed twice.`
+        : `Tag key "${tag.Key}" is listed twice. Keys are case insensitive.`;
+    }
+    seen.add(normalized);
  }

  return null;
@@ -730,7 +734,7 @@ const iamTagEditor = {
                  <svg class="w-5 h-5 text-blue-600 flex-shrink-0 mt-0.5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/></svg>
                  <div class="text-sm text-blue-800">
                    <p class="font-medium">About Tags</p>
-                    <p class="mt-1">Key/value labels for grouping and search. They are also readable from policy conditions as <code class="font-mono">aws:PrincipalTag/&lt;key&gt;</code> for the tagged identity and <code class="font-mono">aws:ResourceTag/&lt;key&gt;</code> for the identity being acted on. Keys are case insensitive; values may be empty.</p>
+                    <p id="iam-tag-about" class="mt-1"></p>
                  </div>
                </div>
              </div>
@@ -762,11 +766,13 @@ const iamTagEditor = {

  /**
   * @param {Object} opts
-   *   title     modal heading
-   *   subtitle  the identity these tags belong to
-   *   tags      current tags, as [{Key, Value}]
-   *   onSave    async ({ set, remove }) => void, where set holds the tags to
-   *             add or overwrite and remove holds the keys to drop
+   *   title             modal heading
+   *   subtitle          the resource these tags belong to
+   *   tags              current tags, as [{Key, Value}]
+   *   caseSensitiveKeys compare keys exactly instead of folding their case
+   *   onSave            async ({ set, remove }) => void, where set holds the
+   *                     tags to add or overwrite and remove holds the keys to
+   *                     drop
   */
  open(opts) {
    this._ensureModal();
@@ -774,6 +780,13 @@ const iamTagEditor = {

    document.getElementById('iam-tag-title').textContent = opts.title || 'Tags';
    document.getElementById('iam-tag-subtitle').textContent = opts.subtitle || '';
+    document.getElementById('iam-tag-about').innerHTML =
+      'Key/value labels for grouping and search. They are also readable from policy conditions as ' +
+      '<code class="font-mono">aws:PrincipalTag/&lt;key&gt;</code> for the tagged identity and ' +
+      '<code class="font-mono">aws:ResourceTag/&lt;key&gt;</code> for the resource being acted on. ' +
+      (opts.caseSensitiveKeys
+        ? 'Keys are case sensitive, so "env" and "ENV" are separate tags; values may be empty.'
+        : 'Keys are case insensitive; values may be empty.');

    const rows = document.getElementById('iam-tag-rows');
    rows.innerHTML = '';
@@ -819,21 +832,23 @@ const iamTagEditor = {
  },

  /**
-   * Diff the edited rows against the tags the modal opened with. A key whose
-   * only change is its casing still lands in set: the tag action overwrites
-   * the stored tag in place, taking the new casing with it.
+   * Diff the edited rows against the tags the modal opened with. Where keys
+   * fold, a key whose only change is its casing still lands in set: the tag
+   * action overwrites the stored tag in place, taking the new casing with
+   * it. Where keys are exact, that same edit is a removal plus an addition.
   */
  _diff(current) {
    const original = this._state.tags || [];
-    const originalByKey = new Map(original.map(tag => [tag.Key.toLowerCase(), tag]));
-    const currentKeys = new Set(current.map(tag => tag.Key.toLowerCase()));
+    const key = tag => (this._state.caseSensitiveKeys ? tag.Key : tag.Key.toLowerCase());
+    const originalByKey = new Map(original.map(tag => [key(tag), tag]));
+    const currentKeys = new Set(current.map(key));

    const set = current.filter(tag => {
-      const before = originalByKey.get(tag.Key.toLowerCase());
+      const before = originalByKey.get(key(tag));
      return !before || before.Key !== tag.Key || (before.Value || '') !== (tag.Value || '');
    });
    const remove = original
-      .filter(tag => !currentKeys.has(tag.Key.toLowerCase()))
+      .filter(tag => !currentKeys.has(key(tag)))
      .map(tag => tag.Key);

    return { set, remove };
@@ -851,7 +866,7 @@ const iamTagEditor = {
    if (orphanValue) { this._setStatus('Every tag needs a key.'); return; }

    const current = iamCollectTags('iam-tag-rows');
-    const error = iamValidateTags(current);
+    const error = iamValidateTags(current, state.caseSensitiveKeys);
    if (error) { this._setStatus(error); return; }

    const { set, remove } = this._diff(current);