fix: role last-used tracking, and record S3 requests in last-used metadata

mirror of https://github.com/versity/versitygw.git synced 2026-09-25 17:34:29 +00:00

Role last-used tracking was missing entirely - `GetRole` returned a `RoleLastUsed` element that nothing ever wrote, rendering the zero time instead of the empty element AWS returns for an unused role - and access key last-used only ever saw the `IAM`/`STS` control plane, so a credential used exclusively against the S3 gateway reported as never used. Roles now record a use whenever a request authenticates with one of their session credentials, through a new `Storer.RecordRoleUsage` mirroring `RecordAccessKeyUsage`, gated on the session's role still being the one it was minted against so a session outliving its role can't attribute its use to a same-named replacement. `LastUsedDate` became a `*time.Time` so an unused role renders as an empty element.

Both records now cover the S3 data plane as well: the gateway sends its configured region and `s3` on evaluate-policy and the IAM service records the caller there, so `GetAccessKeyLastUsed's` `ServiceName` is now iam, sts or s3. That call was chosen over derive-signing-key, which runs before signature verification and takes its region and service from the caller's own `Authorization` header - recording there would let anyone who knows an access key id refresh and poison another identity's audit record. Requests denied by a bucket policy or made against a public bucket are not recorded, since neither reaches identity-policy evaluation. To keep per-request recording affordable, an update is skipped while the stored record has the same service and region and is under a minute old; a change of either is written through immediately.

Assuming a role is not a use, a request denied by an identity policy is, and both successful and denied S3 requests update the record. Also moves the `OIDC-dependent` tests into the `s3-iam-session` group so runoidctests.sh runs a single group.

This commit is contained in:

niksis02

2026-09-01 19:55:27 +04:00

parent 7a1a3e4775

commit afbee5be01

23 changed files with 1235 additions and 311 deletions

									
										runoidctests.sh
									
		+1
		-5
	
												View File
												
				@@ -95,11 +95,7 @@ echo "Starting the s3 gateway backed by it"

				GW_PID=$!

				wait_for_server "s3 gateway" "http://127.0.0.1:$GW_PORT/healthz" "$GW_PID"

				echo "Running the live GitHub OIDC web-identity test"

				./versitygw test -a user -s pass -e "http://127.0.0.1:$IAM_PORT" \

					IAMAssumeRoleWithWebIdentity_github_oidc_live

				echo "Running the s3 assumed-role session access control tests"

				echo "Running the tests that need a real OIDC identity provider"

				./versitygw test -a user -s pass \

					-e "http://127.0.0.1:$GW_PORT" \

					--iam-endpoint "http://127.0.0.1:$IAM_PORT" \