feat: add IAM user access key management

Add `CreateAccessKey`, `UpdateAccessKey`, `DeleteAccessKey`, `ListAccessKeys`, and `GetAccessKeyLastUsed` actions for managing user access keys and retrieving their latest usage details. Generate AWS-style access key IDs and secrets, validate key identifiers and statuses, enforce per-user key quotas, and prevent deleting users that still own access keys. Persist access keys across internal and Vault storage backends with ownership indexing, pagination, and IAM-compatible errors and XML responses.
2026-08-21 14:46:19 +00:00 · 2026-08-15 17:38:26 +04:00
parent 3227a629dc
commit a884d52af4
19 changed files with 2129 additions and 27 deletions
@@ -50,16 +50,25 @@ func NewInternal(dir string) (Storer, error) {

 type iamConfig struct {
 	Users map[string]types.User `json:"users"`
+	// AccessKeyIndex maps an access key id to the username that owns it,
+	// so GetAccessKeyLastUsed can resolve a key without scanning every user.
+	AccessKeyIndex map[string]string `json:"accessKeyIndex"`
 }

 func defaultIAMConfig() iamConfig {
-	return iamConfig{Users: map[string]types.User{}}
+	return iamConfig{
+		Users:          map[string]types.User{},
+		AccessKeyIndex: map[string]string{},
+	}
 }

 func normalizeIAMConfig(conf *iamConfig) {
 	if conf.Users == nil {
 		conf.Users = make(map[string]types.User)
 	}
+	if conf.AccessKeyIndex == nil {
+		conf.AccessKeyIndex = make(map[string]string)
+	}
 }

 func (s *InternalStore) CreateUser(_ context.Context, user types.User) (*types.User, error) {
@@ -100,9 +109,13 @@ func (s *InternalStore) DeleteUser(_ context.Context, username string) error {
 			return nil, err
 		}

-		if _, ok := conf.Users[username]; !ok {
+		user, ok := conf.Users[username]
+		if !ok {
 			return nil, iamerr.NoSuchEntityUser(username)
 		}
+		if len(user.AccessKeys) > 0 {
+			return nil, iamerr.GetAPIError(iamerr.ErrDeleteConflict)
+		}

 		delete(conf.Users, username)
 		return json.Marshal(conf)
@@ -214,6 +227,9 @@ func (s *InternalStore) UpdateUser(_ context.Context, input UpdateUserInput) (*t

 		if user.UserName != input.UserName {
 			delete(conf.Users, input.UserName)
+			for _, key := range user.AccessKeys {
+				conf.AccessKeyIndex[key.AccessKeyId] = user.UserName
+			}
 		}
 		conf.Users[user.UserName] = user
 		updated = user
@@ -226,8 +242,212 @@ func (s *InternalStore) UpdateUser(_ context.Context, input UpdateUserInput) (*t
 	return cloneUser(updated), nil
 }

+func (s *InternalStore) CreateAccessKey(_ context.Context, input CreateAccessKeyInput) (*types.AccessKey, error) {
+	s.Lock()
+	defer s.Unlock()
+
+	var created types.AccessKey
+	if err := s.engine.StoreIAM(func(data []byte) ([]byte, error) {
+		conf, err := s.engine.ParseIAM(data)
+		if err != nil {
+			return nil, err
+		}
+
+		user, ok := conf.Users[input.UserName]
+		if !ok {
+			return nil, iamerr.NoSuchEntityUser(input.UserName)
+		}
+		if len(user.AccessKeys) >= MaxAccessKeysPerUser {
+			return nil, iamerr.AccessKeysLimitExceeded(MaxAccessKeysPerUser)
+		}
+		if _, ok := conf.AccessKeyIndex[input.AccessKeyID]; ok {
+			return nil, ErrAccessKeyIDAlreadyExists
+		}
+
+		user.AccessKeys = append(user.AccessKeys, types.AccessKeyEntry{
+			AccessKeyId:     input.AccessKeyID,
+			SecretAccessKey: input.SecretAccessKey,
+			Status:          input.Status,
+			CreateDate:      input.CreateDate,
+		})
+		conf.Users[input.UserName] = user
+		conf.AccessKeyIndex[input.AccessKeyID] = input.UserName
+
+		created = types.AccessKey{
+			UserName:        input.UserName,
+			AccessKeyId:     input.AccessKeyID,
+			Status:          input.Status,
+			SecretAccessKey: input.SecretAccessKey,
+			CreateDate:      input.CreateDate,
+		}
+
+		return json.Marshal(conf)
+	}); err != nil {
+		return nil, unwrapAPIError(err)
+	}
+
+	return &created, nil
+}
+
+func (s *InternalStore) UpdateAccessKey(_ context.Context, input UpdateAccessKeyInput) error {
+	s.Lock()
+	defer s.Unlock()
+
+	err := s.engine.StoreIAM(func(data []byte) ([]byte, error) {
+		conf, err := s.engine.ParseIAM(data)
+		if err != nil {
+			return nil, err
+		}
+
+		user, ok := conf.Users[input.UserName]
+		if !ok {
+			return nil, iamerr.NoSuchEntityUser(input.UserName)
+		}
+
+		found := false
+		for i, key := range user.AccessKeys {
+			if key.AccessKeyId == input.AccessKeyID {
+				user.AccessKeys[i].Status = input.Status
+				found = true
+				break
+			}
+		}
+		if !found {
+			return nil, iamerr.NoSuchEntityAccessKey(input.AccessKeyID)
+		}
+
+		conf.Users[input.UserName] = user
+		return json.Marshal(conf)
+	})
+	return unwrapAPIError(err)
+}
+
+func (s *InternalStore) DeleteAccessKey(_ context.Context, username, accessKeyID string) error {
+	s.Lock()
+	defer s.Unlock()
+
+	err := s.engine.StoreIAM(func(data []byte) ([]byte, error) {
+		conf, err := s.engine.ParseIAM(data)
+		if err != nil {
+			return nil, err
+		}
+
+		user, ok := conf.Users[username]
+		if !ok {
+			return nil, iamerr.NoSuchEntityUser(username)
+		}
+
+		idx := -1
+		for i, key := range user.AccessKeys {
+			if key.AccessKeyId == accessKeyID {
+				idx = i
+				break
+			}
+		}
+		if idx == -1 {
+			return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+		}
+
+		user.AccessKeys = slices.Delete(user.AccessKeys, idx, idx+1)
+		conf.Users[username] = user
+		delete(conf.AccessKeyIndex, accessKeyID)
+
+		return json.Marshal(conf)
+	})
+	return unwrapAPIError(err)
+}
+
+func (s *InternalStore) GetAccessKeyLastUsed(_ context.Context, accessKeyID string) (*GetAccessKeyLastUsedOutput, error) {
+	s.RLock()
+	defer s.RUnlock()
+
+	conf, err := s.engine.GetIAM()
+	if err != nil {
+		return nil, err
+	}
+
+	username, ok := conf.AccessKeyIndex[accessKeyID]
+	if !ok {
+		return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+	}
+	user, ok := conf.Users[username]
+	if !ok {
+		return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+	}
+
+	for _, key := range user.AccessKeys {
+		if key.AccessKeyId == accessKeyID {
+			return &GetAccessKeyLastUsedOutput{
+				UserName:     username,
+				LastUsedDate: key.LastUsedDate,
+				ServiceName:  key.LastUsedService,
+				Region:       key.LastUsedRegion,
+			}, nil
+		}
+	}
+
+	return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+}
+
+func (s *InternalStore) ListAccessKeys(_ context.Context, input ListAccessKeysInput) (*ListAccessKeysOutput, error) {
+	s.RLock()
+	defer s.RUnlock()
+
+	conf, err := s.engine.GetIAM()
+	if err != nil {
+		return nil, err
+	}
+
+	user, ok := conf.Users[input.UserName]
+	if !ok {
+		return nil, iamerr.NoSuchEntityUser(input.UserName)
+	}
+
+	keys := make([]types.AccessKeyMetadata, 0, len(user.AccessKeys))
+	for _, key := range user.AccessKeys {
+		keys = append(keys, types.AccessKeyMetadata{
+			UserName:    input.UserName,
+			AccessKeyId: key.AccessKeyId,
+			Status:      key.Status,
+			CreateDate:  key.CreateDate,
+		})
+	}
+	sort.Slice(keys, func(i, j int) bool {
+		return keys[i].AccessKeyId < keys[j].AccessKeyId
+	})
+
+	start := 0
+	if input.Marker != "" {
+		start = len(keys)
+		for i, key := range keys {
+			if key.AccessKeyId == input.Marker {
+				start = i + 1
+				break
+			}
+		}
+	}
+	keys = keys[start:]
+
+	limit := len(keys)
+	if input.MaxItems > 0 && int(input.MaxItems) < limit {
+		limit = int(input.MaxItems)
+	}
+
+	out := &ListAccessKeysOutput{
+		AccessKeys: make([]types.AccessKeyMetadata, limit),
+	}
+	copy(out.AccessKeys, keys[:limit])
+	if limit < len(keys) {
+		out.IsTruncated = true
+		out.Marker = out.AccessKeys[limit-1].AccessKeyId
+	}
+
+	return out, nil
+}
+
 func cloneUser(user types.User) *types.User {
 	cloned := user
 	cloned.Tags = slices.Clone(user.Tags)
+	cloned.AccessKeys = slices.Clone(user.AccessKeys)
 	return &cloned
 }
@@ -19,13 +19,19 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"time"

 	"github.com/versity/versitygw/iamapi/iamerr"
 	"github.com/versity/versitygw/iamapi/types"
 )

+// MaxAccessKeysPerUser is the maximum number of access keys a single IAM
+// user may hold at once, matching the AWS IAM quota.
+const MaxAccessKeysPerUser = 2
+
 var (
-	ErrUserIDAlreadyExists = errors.New("iamapi: user id already exists")
+	ErrUserIDAlreadyExists      = errors.New("iamapi: user id already exists")
+	ErrAccessKeyIDAlreadyExists = errors.New("iamapi: access key id already exists")
 )

 type ListUsersInput struct {
@@ -47,6 +53,39 @@ type UpdateUserInput struct {
 	NewArn      string
 }

+type CreateAccessKeyInput struct {
+	UserName        string
+	AccessKeyID     string
+	SecretAccessKey string
+	Status          string
+	CreateDate      time.Time
+}
+
+type UpdateAccessKeyInput struct {
+	UserName    string
+	AccessKeyID string
+	Status      string
+}
+
+type ListAccessKeysInput struct {
+	UserName string
+	Marker   string
+	MaxItems int32
+}
+
+type ListAccessKeysOutput struct {
+	AccessKeys  []types.AccessKeyMetadata
+	IsTruncated bool
+	Marker      string
+}
+
+type GetAccessKeyLastUsedOutput struct {
+	UserName     string
+	LastUsedDate time.Time
+	ServiceName  string
+	Region       string
+}
+
 // Storer is the IAM API storage backend contract.
 type Storer interface {
 	CreateUser(ctx context.Context, user types.User) (*types.User, error)
@@ -54,6 +93,12 @@ type Storer interface {
 	GetUser(ctx context.Context, username string) (*types.User, error)
 	ListUsers(ctx context.Context, input ListUsersInput) (*ListUsersOutput, error)
 	UpdateUser(ctx context.Context, input UpdateUserInput) (*types.User, error)
+
+	CreateAccessKey(ctx context.Context, input CreateAccessKeyInput) (*types.AccessKey, error)
+	UpdateAccessKey(ctx context.Context, input UpdateAccessKeyInput) error
+	DeleteAccessKey(ctx context.Context, username, accessKeyID string) error
+	GetAccessKeyLastUsed(ctx context.Context, accessKeyID string) (*GetAccessKeyLastUsedOutput, error)
+	ListAccessKeys(ctx context.Context, input ListAccessKeysInput) (*ListAccessKeysOutput, error)
 }

 func unwrapAPIError(err error) error {
@@ -198,6 +198,22 @@ func TestInternalStoreUserCRUDAndPagination(t *testing.T) {
 		t.Fatalf("reopened tags = %#v, want %#v", reopenedUser.Tags, users[0].Tags)
 	}

+	if _, err := reopened.CreateAccessKey(ctx, CreateAccessKeyInput{
+		UserName:        "zoe",
+		AccessKeyID:     "AKIAZZZZZZZZZZZZZZZZ",
+		SecretAccessKey: "secret",
+		Status:          "Active",
+		CreateDate:      created,
+	}); err != nil {
+		t.Fatalf("CreateAccessKey: %v", err)
+	}
+	if err := reopened.DeleteUser(ctx, "zoe"); !errors.Is(err, iamerr.GetAPIError(iamerr.ErrDeleteConflict)) {
+		t.Fatalf("DeleteUser with access keys err = %v, want DeleteConflict", err)
+	}
+	if err := reopened.DeleteAccessKey(ctx, "zoe", "AKIAZZZZZZZZZZZZZZZZ"); err != nil {
+		t.Fatalf("DeleteAccessKey: %v", err)
+	}
+
 	if err := reopened.DeleteUser(ctx, "zoe"); err != nil {
 		t.Fatalf("DeleteUser: %v", err)
 	}
@@ -20,6 +20,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -228,9 +229,13 @@ func (s *VaultStore) CreateUser(_ context.Context, user types.User) (*types.User
 }

 func (s *VaultStore) DeleteUser(ctx context.Context, username string) error {
-	if _, err := s.GetUser(ctx, username); err != nil {
+	user, err := s.GetUser(ctx, username)
+	if err != nil {
 		return err
 	}
+	if len(user.AccessKeys) > 0 {
+		return iamerr.GetAPIError(iamerr.ErrDeleteConflict)
+	}
 	return s.deleteByPath(username)
 }

@@ -366,17 +371,186 @@ func (s *VaultStore) UpdateUser(ctx context.Context, input UpdateUserInput) (*ty
 		if err := s.deleteByPath(input.UserName); err != nil {
 			return nil, err
 		}
-	} else {
-		// Delete all versions then re-create so CAS=0 succeeds.
-		if err := s.deleteByPath(input.UserName); err != nil {
-			return nil, err
+	} else if _, err := s.replaceUser(ctx, *user); err != nil {
+		return nil, err
+	}
+
+	return cloneUser(*user), nil
+}
+
+// replaceUser overwrites the stored document for user.UserName by deleting
+// all existing versions and recreating with CAS=0.
+func (s *VaultStore) replaceUser(ctx context.Context, user types.User) (*types.User, error) {
+	if err := s.deleteByPath(user.UserName); err != nil {
+		return nil, err
+	}
+	return s.CreateUser(ctx, user)
+}
+
+func (s *VaultStore) CreateAccessKey(ctx context.Context, input CreateAccessKeyInput) (*types.AccessKey, error) {
+	user, err := s.GetUser(ctx, input.UserName)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(user.AccessKeys) >= MaxAccessKeysPerUser {
+		return nil, iamerr.AccessKeysLimitExceeded(MaxAccessKeysPerUser)
+	}
+	for _, key := range user.AccessKeys {
+		if key.AccessKeyId == input.AccessKeyID {
+			return nil, ErrAccessKeyIDAlreadyExists
 		}
-		if _, err := s.CreateUser(ctx, *user); err != nil {
+	}
+
+	user.AccessKeys = append(user.AccessKeys, types.AccessKeyEntry{
+		AccessKeyId:     input.AccessKeyID,
+		SecretAccessKey: input.SecretAccessKey,
+		Status:          input.Status,
+		CreateDate:      input.CreateDate,
+	})
+
+	if _, err := s.replaceUser(ctx, *user); err != nil {
+		return nil, err
+	}
+
+	return &types.AccessKey{
+		UserName:        input.UserName,
+		AccessKeyId:     input.AccessKeyID,
+		Status:          input.Status,
+		SecretAccessKey: input.SecretAccessKey,
+		CreateDate:      input.CreateDate,
+	}, nil
+}
+
+func (s *VaultStore) UpdateAccessKey(ctx context.Context, input UpdateAccessKeyInput) error {
+	user, err := s.GetUser(ctx, input.UserName)
+	if err != nil {
+		return err
+	}
+
+	found := false
+	for i, key := range user.AccessKeys {
+		if key.AccessKeyId == input.AccessKeyID {
+			user.AccessKeys[i].Status = input.Status
+			found = true
+			break
+		}
+	}
+	if !found {
+		return iamerr.NoSuchEntityAccessKey(input.AccessKeyID)
+	}
+
+	_, err = s.replaceUser(ctx, *user)
+	return err
+}
+
+func (s *VaultStore) DeleteAccessKey(ctx context.Context, username, accessKeyID string) error {
+	user, err := s.GetUser(ctx, username)
+	if err != nil {
+		return err
+	}
+
+	idx := -1
+	for i, key := range user.AccessKeys {
+		if key.AccessKeyId == accessKeyID {
+			idx = i
+			break
+		}
+	}
+	if idx == -1 {
+		return iamerr.NoSuchEntityAccessKey(accessKeyID)
+	}
+
+	user.AccessKeys = slices.Delete(user.AccessKeys, idx, idx+1)
+
+	_, err = s.replaceUser(ctx, *user)
+	return err
+}
+
+func (s *VaultStore) GetAccessKeyLastUsed(ctx context.Context, accessKeyID string) (*GetAccessKeyLastUsedOutput, error) {
+	resp, err := s.client.Secrets.KvV2List(context.Background(), s.secretStoragePath, s.kvReqOpts...)
+	if err != nil {
+		if vault.IsErrorStatus(err, http.StatusNotFound) {
+			return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+		}
+		if reauthErr := s.reAuthIfNeeded(err); reauthErr != nil {
+			return nil, reauthErr
+		}
+		resp, err = s.client.Secrets.KvV2List(context.Background(), s.secretStoragePath, s.kvReqOpts...)
+		if err != nil {
+			if vault.IsErrorStatus(err, http.StatusNotFound) {
+				return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+			}
 			return nil, err
 		}
 	}

-	return cloneUser(*user), nil
+	for _, username := range resp.Data.Keys {
+		user, err := s.GetUser(ctx, username)
+		if err != nil {
+			return nil, err
+		}
+		for _, key := range user.AccessKeys {
+			if key.AccessKeyId == accessKeyID {
+				return &GetAccessKeyLastUsedOutput{
+					UserName:     username,
+					LastUsedDate: key.LastUsedDate,
+					ServiceName:  key.LastUsedService,
+					Region:       key.LastUsedRegion,
+				}, nil
+			}
+		}
+	}
+
+	return nil, iamerr.NoSuchEntityAccessKey(accessKeyID)
+}
+
+func (s *VaultStore) ListAccessKeys(ctx context.Context, input ListAccessKeysInput) (*ListAccessKeysOutput, error) {
+	user, err := s.GetUser(ctx, input.UserName)
+	if err != nil {
+		return nil, err
+	}
+
+	keys := make([]types.AccessKeyMetadata, 0, len(user.AccessKeys))
+	for _, key := range user.AccessKeys {
+		keys = append(keys, types.AccessKeyMetadata{
+			UserName:    input.UserName,
+			AccessKeyId: key.AccessKeyId,
+			Status:      key.Status,
+			CreateDate:  key.CreateDate,
+		})
+	}
+	sort.Slice(keys, func(i, j int) bool {
+		return keys[i].AccessKeyId < keys[j].AccessKeyId
+	})
+
+	start := 0
+	if input.Marker != "" {
+		start = len(keys)
+		for i, key := range keys {
+			if key.AccessKeyId == input.Marker {
+				start = i + 1
+				break
+			}
+		}
+	}
+	keys = keys[start:]
+
+	limit := len(keys)
+	if input.MaxItems > 0 && int(input.MaxItems) < limit {
+		limit = int(input.MaxItems)
+	}
+
+	out := &ListAccessKeysOutput{
+		AccessKeys: make([]types.AccessKeyMetadata, limit),
+	}
+	copy(out.AccessKeys, keys[:limit])
+	if limit < len(keys) {
+		out.IsTruncated = true
+		out.Marker = out.AccessKeys[limit-1].AccessKeyId
+	}
+
+	return out, nil
 }

 // deleteByPath permanently removes a secret and all its versions without