mirror of
https://github.com/versity/versitygw.git
synced 2026-09-24 00:44:23 +00:00
feat: add IAM role inline policy CRUD
Add support for the `PutRolePolicy`, `GetRolePolicy`, `DeleteRolePolicy`, and `ListRolePolicies` actions in the IAM-compatible gateway service, extending role management with the same inline-policy lifecycle already available for IAM users. `PutRolePolicy` validates the policy name and document, parses the document for AWS-compatible syntax and semantic errors (missing actions/resources, malformed ARNs, disallowed principals, duplicate statement IDs, and so on), and rejects documents once the role's aggregate inline-policy size would exceed `MaxInlinePolicyBytesPerRole` (10240 bytes, distinct from the 2048-byte quota enforced for users). Putting a policy under an existing name overwrites its document in place. `GetRolePolicy` and `DeleteRolePolicy` look up or remove a named inline policy from a role, returning a `NoSuchEntity` error when the role or the policy is not found. `ListRolePolicies` returns a role's inline policy names in sorted order with marker-based pagination. These actions are implemented for both the internal file-backed store and the Vault-backed store, wired into the IAM API router, and given their own XML response types under `iamapi/types`. A new `NoSuchEntityRolePolicy` error was added to `iamapi/iamerr` to mirror the existing user-policy error.
This commit is contained in:
niksis02
@@ -1329,6 +1329,7 @@ func TestIAMDeleteRole(ts *TestState) {
|
||||
ts.Run(IAMDeleteRole_invalid_role_name)
|
||||
ts.Run(IAMDeleteRole_long_role_name)
|
||||
ts.Run(IAMDeleteRole_non_existing_role)
|
||||
ts.Run(IAMDeleteRole_has_policies)
|
||||
ts.Run(IAMDeleteRole_success)
|
||||
}
|
||||
|
||||
@@ -1344,6 +1345,47 @@ func TestIAMUpdateAssumeRolePolicy(ts *TestState) {
|
||||
ts.Run(IAMUpdateAssumeRolePolicy_trust_policy_document_grammar)
|
||||
}
|
||||
|
||||
func TestIAMPutRolePolicy(ts *TestState) {
|
||||
ts.Run(IAMPutRolePolicy_missing_role_name)
|
||||
ts.Run(IAMPutRolePolicy_missing_policy_name)
|
||||
ts.Run(IAMPutRolePolicy_missing_policy_document)
|
||||
ts.Run(IAMPutRolePolicy_invalid_policy_name)
|
||||
ts.Run(IAMPutRolePolicy_long_policy_name)
|
||||
ts.Run(IAMPutRolePolicy_non_ascii_policy_document)
|
||||
ts.Run(IAMPutRolePolicy_non_existing_role)
|
||||
ts.Run(IAMPutRolePolicy_malformed_policy_document)
|
||||
ts.Run(IAMPutRolePolicy_principal_not_allowed)
|
||||
ts.Run(IAMPutRolePolicy_limit_exceeded)
|
||||
ts.Run(IAMPutRolePolicy_success)
|
||||
ts.Run(IAMPutRolePolicy_overwrite_updates_existing)
|
||||
}
|
||||
|
||||
func TestIAMGetRolePolicy(ts *TestState) {
|
||||
ts.Run(IAMGetRolePolicy_missing_role_name)
|
||||
ts.Run(IAMGetRolePolicy_missing_policy_name)
|
||||
ts.Run(IAMGetRolePolicy_non_existing_role)
|
||||
ts.Run(IAMGetRolePolicy_non_existing_policy)
|
||||
ts.Run(IAMGetRolePolicy_success)
|
||||
}
|
||||
|
||||
func TestIAMDeleteRolePolicy(ts *TestState) {
|
||||
ts.Run(IAMDeleteRolePolicy_missing_role_name)
|
||||
ts.Run(IAMDeleteRolePolicy_missing_policy_name)
|
||||
ts.Run(IAMDeleteRolePolicy_non_existing_role)
|
||||
ts.Run(IAMDeleteRolePolicy_non_existing_policy)
|
||||
ts.Run(IAMDeleteRolePolicy_success)
|
||||
ts.Run(IAMDeleteRolePolicy_blocks_role_deletion)
|
||||
}
|
||||
|
||||
func TestIAMListRolePolicies(ts *TestState) {
|
||||
ts.Run(IAMListRolePolicies_missing_role_name)
|
||||
ts.Run(IAMListRolePolicies_non_existing_role)
|
||||
ts.Run(IAMListRolePolicies_invalid_max_items)
|
||||
ts.Run(IAMListRolePolicies_empty_result)
|
||||
ts.Run(IAMListRolePolicies_success)
|
||||
ts.Run(IAMListRolePolicies_pagination)
|
||||
}
|
||||
|
||||
func TestIAM(ts *TestState) {
|
||||
TestIAMAuth(ts)
|
||||
TestIAMQueryAuth(ts)
|
||||
@@ -1366,6 +1408,10 @@ func TestIAM(ts *TestState) {
|
||||
TestIAMListRoles(ts)
|
||||
TestIAMDeleteRole(ts)
|
||||
TestIAMUpdateAssumeRolePolicy(ts)
|
||||
TestIAMPutRolePolicy(ts)
|
||||
TestIAMGetRolePolicy(ts)
|
||||
TestIAMDeleteRolePolicy(ts)
|
||||
TestIAMListRolePolicies(ts)
|
||||
}
|
||||
|
||||
func TestAccessControl(ts *TestState) {
|
||||
@@ -1871,6 +1917,7 @@ func GetIntTests() IntTests {
|
||||
"IAMDeleteRole_invalid_role_name": IAMDeleteRole_invalid_role_name,
|
||||
"IAMDeleteRole_long_role_name": IAMDeleteRole_long_role_name,
|
||||
"IAMDeleteRole_non_existing_role": IAMDeleteRole_non_existing_role,
|
||||
"IAMDeleteRole_has_policies": IAMDeleteRole_has_policies,
|
||||
"IAMDeleteRole_success": IAMDeleteRole_success,
|
||||
"IAMUpdateAssumeRolePolicy_missing_role_name": IAMUpdateAssumeRolePolicy_missing_role_name,
|
||||
"IAMUpdateAssumeRolePolicy_missing_policy_document": IAMUpdateAssumeRolePolicy_missing_policy_document,
|
||||
@@ -1881,6 +1928,35 @@ func GetIntTests() IntTests {
|
||||
"IAMUpdateAssumeRolePolicy_trust_policy_size_limit_exceeded": IAMUpdateAssumeRolePolicy_trust_policy_size_limit_exceeded,
|
||||
"IAMUpdateAssumeRolePolicy_success": IAMUpdateAssumeRolePolicy_success,
|
||||
"IAMUpdateAssumeRolePolicy_trust_policy_document_grammar": IAMUpdateAssumeRolePolicy_trust_policy_document_grammar,
|
||||
"IAMPutRolePolicy_missing_role_name": IAMPutRolePolicy_missing_role_name,
|
||||
"IAMPutRolePolicy_missing_policy_name": IAMPutRolePolicy_missing_policy_name,
|
||||
"IAMPutRolePolicy_missing_policy_document": IAMPutRolePolicy_missing_policy_document,
|
||||
"IAMPutRolePolicy_invalid_policy_name": IAMPutRolePolicy_invalid_policy_name,
|
||||
"IAMPutRolePolicy_long_policy_name": IAMPutRolePolicy_long_policy_name,
|
||||
"IAMPutRolePolicy_non_ascii_policy_document": IAMPutRolePolicy_non_ascii_policy_document,
|
||||
"IAMPutRolePolicy_non_existing_role": IAMPutRolePolicy_non_existing_role,
|
||||
"IAMPutRolePolicy_malformed_policy_document": IAMPutRolePolicy_malformed_policy_document,
|
||||
"IAMPutRolePolicy_principal_not_allowed": IAMPutRolePolicy_principal_not_allowed,
|
||||
"IAMPutRolePolicy_limit_exceeded": IAMPutRolePolicy_limit_exceeded,
|
||||
"IAMPutRolePolicy_success": IAMPutRolePolicy_success,
|
||||
"IAMPutRolePolicy_overwrite_updates_existing": IAMPutRolePolicy_overwrite_updates_existing,
|
||||
"IAMGetRolePolicy_missing_role_name": IAMGetRolePolicy_missing_role_name,
|
||||
"IAMGetRolePolicy_missing_policy_name": IAMGetRolePolicy_missing_policy_name,
|
||||
"IAMGetRolePolicy_non_existing_role": IAMGetRolePolicy_non_existing_role,
|
||||
"IAMGetRolePolicy_non_existing_policy": IAMGetRolePolicy_non_existing_policy,
|
||||
"IAMGetRolePolicy_success": IAMGetRolePolicy_success,
|
||||
"IAMDeleteRolePolicy_missing_role_name": IAMDeleteRolePolicy_missing_role_name,
|
||||
"IAMDeleteRolePolicy_missing_policy_name": IAMDeleteRolePolicy_missing_policy_name,
|
||||
"IAMDeleteRolePolicy_non_existing_role": IAMDeleteRolePolicy_non_existing_role,
|
||||
"IAMDeleteRolePolicy_non_existing_policy": IAMDeleteRolePolicy_non_existing_policy,
|
||||
"IAMDeleteRolePolicy_success": IAMDeleteRolePolicy_success,
|
||||
"IAMDeleteRolePolicy_blocks_role_deletion": IAMDeleteRolePolicy_blocks_role_deletion,
|
||||
"IAMListRolePolicies_missing_role_name": IAMListRolePolicies_missing_role_name,
|
||||
"IAMListRolePolicies_non_existing_role": IAMListRolePolicies_non_existing_role,
|
||||
"IAMListRolePolicies_invalid_max_items": IAMListRolePolicies_invalid_max_items,
|
||||
"IAMListRolePolicies_empty_result": IAMListRolePolicies_empty_result,
|
||||
"IAMListRolePolicies_success": IAMListRolePolicies_success,
|
||||
"IAMListRolePolicies_pagination": IAMListRolePolicies_pagination,
|
||||
"PresignedAuth_security_token_not_supported": PresignedAuth_security_token_not_supported,
|
||||
"PresignedAuth_unsupported_algorithm": PresignedAuth_unsupported_algorithm,
|
||||
"PresignedAuth_ECDSA_not_supported": PresignedAuth_ECDSA_not_supported,
|
||||
|
||||
@@ -67,6 +67,39 @@ func IAMDeleteRole_non_existing_role(s *S3Conf) error {
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteRole_has_policies(s *S3Conf) error {
|
||||
testName := "IAMDeleteRole_has_policies"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("p"),
|
||||
PolicyDocument: aws.String(validIAMPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := checkIAMApiErr(deleteIAMRole(client, roleName), iamerr.GetAPIError(iamerr.ErrDeleteConflictPolicies))
|
||||
|
||||
deletePolicyErr := deleteIAMRolePolicy(client, roleName, "p")
|
||||
deleteRoleErr := deleteIAMRole(client, roleName)
|
||||
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
if deletePolicyErr != nil {
|
||||
return deletePolicyErr
|
||||
}
|
||||
return deleteRoleErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteRole_success(s *S3Conf) error {
|
||||
testName := "IAMDeleteRole_success"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
|
||||
@@ -0,0 +1,212 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"time"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
|
||||
"github.com/aws/aws-sdk-go-v2/service/iam"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
)
|
||||
|
||||
func IAMDeleteRolePolicy_missing_role_name(s *S3Conf) error {
|
||||
testName := "IAMDeleteRolePolicy_missing_role_name"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"DeleteRolePolicy"},
|
||||
"Version": {"2010-05-08"},
|
||||
"PolicyName": {"p"},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingValue("roleName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteRolePolicy_missing_policy_name(s *S3Conf) error {
|
||||
testName := "IAMDeleteRolePolicy_missing_policy_name"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"DeleteRolePolicy"},
|
||||
"Version": {"2010-05-08"},
|
||||
"RoleName": {newIAMRoleName()},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingValue("policyName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteRolePolicy_non_existing_role(s *S3Conf) error {
|
||||
testName := "IAMDeleteRolePolicy_non_existing_role"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := "non-existing-" + genRandString(16)
|
||||
_, err := deleteIAMRolePolicyRaw(client, &iam.DeleteRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("p"),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.NoSuchEntityRole(roleName))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteRolePolicy_non_existing_policy(s *S3Conf) error {
|
||||
testName := "IAMDeleteRolePolicy_non_existing_policy"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := checkIAMApiErr(
|
||||
func() error {
|
||||
_, err := deleteIAMRolePolicyRaw(client, &iam.DeleteRolePolicyInput{RoleName: &roleName, PolicyName: aws.String("missing")})
|
||||
return err
|
||||
}(),
|
||||
iamerr.NoSuchEntityRolePolicy(roleName, "missing"),
|
||||
)
|
||||
|
||||
deleteErr := deleteIAMRole(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteRolePolicy_success(s *S3Conf) error {
|
||||
testName := "IAMDeleteRolePolicy_success"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
if _, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("p"),
|
||||
PolicyDocument: aws.String(validIAMPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
out, err := deleteIAMRolePolicyRaw(client, &iam.DeleteRolePolicyInput{RoleName: &roleName, PolicyName: aws.String("p")})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if requestID, ok := awsmiddleware.GetRequestIDMetadata(out.ResultMetadata); !ok || requestID == "" {
|
||||
return fmt.Errorf("expected DeleteRolePolicy response request id")
|
||||
}
|
||||
|
||||
_, err = getIAMRolePolicy(client, &iam.GetRolePolicyInput{RoleName: &roleName, PolicyName: aws.String("p")})
|
||||
return checkIAMApiErr(err, iamerr.NoSuchEntityRolePolicy(roleName, "p"))
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMRole(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMDeleteRolePolicy_blocks_role_deletion(s *S3Conf) error {
|
||||
testName := "IAMDeleteRolePolicy_blocks_role_deletion"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("p"),
|
||||
PolicyDocument: aws.String(validIAMPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := checkIAMApiErr(deleteIAMRole(client, roleName), iamerr.GetAPIError(iamerr.ErrDeleteConflictPolicies))
|
||||
|
||||
deletePolicyErr := deleteIAMRolePolicy(client, roleName, "p")
|
||||
deleteRoleErr := deleteIAMRole(client, roleName)
|
||||
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
if deletePolicyErr != nil {
|
||||
return deletePolicyErr
|
||||
}
|
||||
return deleteRoleErr
|
||||
})
|
||||
}
|
||||
|
||||
func deleteIAMRolePolicyRaw(client *iam.Client, input *iam.DeleteRolePolicyInput) (*iam.DeleteRolePolicyOutput, error) {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), shortTimeout)
|
||||
defer cancel()
|
||||
return client.DeleteRolePolicy(ctx, input)
|
||||
}
|
||||
|
||||
func deleteIAMRolePolicy(client *iam.Client, roleName, policyName string) error {
|
||||
_, err := deleteIAMRolePolicyRaw(client, &iam.DeleteRolePolicyInput{RoleName: &roleName, PolicyName: &policyName})
|
||||
return err
|
||||
}
|
||||
|
||||
// deleteIAMRoleAndPolicies deletes all of the role's inline policies before
|
||||
// deleting the role, since DeleteRole rejects roles with policies still
|
||||
// attached. Use this for test cleanup after a test has created inline
|
||||
// policies.
|
||||
func deleteIAMRoleAndPolicies(client *iam.Client, roleName string) error {
|
||||
out, err := listIAMRolePolicies(client, &iam.ListRolePoliciesInput{RoleName: &roleName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
for _, policyName := range out.PolicyNames {
|
||||
if err := deleteIAMRolePolicy(client, roleName, policyName); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return deleteIAMRole(client, roleName)
|
||||
}
|
||||
@@ -0,0 +1,171 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"time"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
|
||||
"github.com/aws/aws-sdk-go-v2/service/iam"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
)
|
||||
|
||||
func IAMGetRolePolicy_missing_role_name(s *S3Conf) error {
|
||||
testName := "IAMGetRolePolicy_missing_role_name"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"GetRolePolicy"},
|
||||
"Version": {"2010-05-08"},
|
||||
"PolicyName": {"p"},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingValue("roleName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMGetRolePolicy_missing_policy_name(s *S3Conf) error {
|
||||
testName := "IAMGetRolePolicy_missing_policy_name"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"GetRolePolicy"},
|
||||
"Version": {"2010-05-08"},
|
||||
"RoleName": {newIAMRoleName()},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingValue("policyName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMGetRolePolicy_non_existing_role(s *S3Conf) error {
|
||||
testName := "IAMGetRolePolicy_non_existing_role"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := "non-existing-" + genRandString(16)
|
||||
_, err := getIAMRolePolicy(client, &iam.GetRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("p"),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.NoSuchEntityRole(roleName))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMGetRolePolicy_non_existing_policy(s *S3Conf) error {
|
||||
testName := "IAMGetRolePolicy_non_existing_policy"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := checkIAMApiErr(
|
||||
func() error {
|
||||
_, err := getIAMRolePolicy(client, &iam.GetRolePolicyInput{RoleName: &roleName, PolicyName: aws.String("missing")})
|
||||
return err
|
||||
}(),
|
||||
iamerr.NoSuchEntityRolePolicy(roleName, "missing"),
|
||||
)
|
||||
|
||||
deleteErr := deleteIAMRole(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMGetRolePolicy_success(s *S3Conf) error {
|
||||
testName := "IAMGetRolePolicy_success"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
if _, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("ReadOnly"),
|
||||
PolicyDocument: aws.String(validIAMPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
out, err := getIAMRolePolicy(client, &iam.GetRolePolicyInput{RoleName: &roleName, PolicyName: aws.String("ReadOnly")})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if out == nil {
|
||||
return fmt.Errorf("expected GetRolePolicy output")
|
||||
}
|
||||
if aws.ToString(out.RoleName) != roleName {
|
||||
return fmt.Errorf("expected role name %q, instead got %q", roleName, aws.ToString(out.RoleName))
|
||||
}
|
||||
if aws.ToString(out.PolicyName) != "ReadOnly" {
|
||||
return fmt.Errorf("expected policy name %q, instead got %q", "ReadOnly", aws.ToString(out.PolicyName))
|
||||
}
|
||||
gotDocument, err := url.QueryUnescape(aws.ToString(out.PolicyDocument))
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to url-decode policy document %q: %w", aws.ToString(out.PolicyDocument), err)
|
||||
}
|
||||
if gotDocument != validIAMPolicyDocument {
|
||||
return fmt.Errorf("expected policy document %q, instead got %q", validIAMPolicyDocument, gotDocument)
|
||||
}
|
||||
if requestID, ok := awsmiddleware.GetRequestIDMetadata(out.ResultMetadata); !ok || requestID == "" {
|
||||
return fmt.Errorf("expected GetRolePolicy response request id")
|
||||
}
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMRoleAndPolicies(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func getIAMRolePolicy(client *iam.Client, input *iam.GetRolePolicyInput) (*iam.GetRolePolicyOutput, error) {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), shortTimeout)
|
||||
defer cancel()
|
||||
return client.GetRolePolicy(ctx, input)
|
||||
}
|
||||
@@ -0,0 +1,235 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"slices"
|
||||
"time"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
|
||||
"github.com/aws/aws-sdk-go-v2/service/iam"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
)
|
||||
|
||||
func IAMListRolePolicies_missing_role_name(s *S3Conf) error {
|
||||
testName := "IAMListRolePolicies_missing_role_name"
|
||||
body := []byte("Action=ListRolePolicies&Version=2010-05-08")
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingValue("roleName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListRolePolicies_non_existing_role(s *S3Conf) error {
|
||||
testName := "IAMListRolePolicies_non_existing_role"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := "non-existing-" + genRandString(16)
|
||||
_, err := listIAMRolePolicies(client, &iam.ListRolePoliciesInput{RoleName: &roleName})
|
||||
return checkIAMApiErr(err, iamerr.NoSuchEntityRole(roleName))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListRolePolicies_invalid_max_items(s *S3Conf) error {
|
||||
testName := "IAMListRolePolicies_invalid_max_items"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := checkIAMApiErr(
|
||||
func() error {
|
||||
_, err := listIAMRolePolicies(client, &iam.ListRolePoliciesInput{RoleName: &roleName, MaxItems: aws.Int32(1001)})
|
||||
return err
|
||||
}(),
|
||||
iamerr.InvalidMaxItems("1001"),
|
||||
)
|
||||
|
||||
deleteErr := deleteIAMRole(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListRolePolicies_empty_result(s *S3Conf) error {
|
||||
testName := "IAMListRolePolicies_empty_result"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
out, err := listIAMRolePolicies(client, &iam.ListRolePoliciesInput{RoleName: &roleName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if len(out.PolicyNames) != 0 {
|
||||
return fmt.Errorf("expected no policies, instead got %v", out.PolicyNames)
|
||||
}
|
||||
if out.IsTruncated {
|
||||
return fmt.Errorf("expected IsTruncated to be false")
|
||||
}
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMRole(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListRolePolicies_success(s *S3Conf) error {
|
||||
testName := "IAMListRolePolicies_success"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
want := []string{"Alpha", "Beta"}
|
||||
for _, name := range want {
|
||||
if _, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String(name),
|
||||
PolicyDocument: aws.String(validIAMPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
out, err := listIAMRolePolicies(client, &iam.ListRolePoliciesInput{RoleName: &roleName})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if requestID, ok := awsmiddleware.GetRequestIDMetadata(out.ResultMetadata); !ok || requestID == "" {
|
||||
return fmt.Errorf("expected ListRolePolicies response request id")
|
||||
}
|
||||
got := slices.Clone(out.PolicyNames)
|
||||
slices.Sort(got)
|
||||
if !slices.Equal(got, want) {
|
||||
return fmt.Errorf("expected policy names %v, instead got %v", want, got)
|
||||
}
|
||||
if out.IsTruncated {
|
||||
return fmt.Errorf("expected IsTruncated to be false")
|
||||
}
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMRoleAndPolicies(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMListRolePolicies_pagination(s *S3Conf) error {
|
||||
testName := "IAMListRolePolicies_pagination"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
want := []string{"Alpha", "Beta", "Gamma"}
|
||||
for _, name := range want {
|
||||
if _, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String(name),
|
||||
PolicyDocument: aws.String(validIAMPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
input := iam.ListRolePoliciesInput{RoleName: &roleName, MaxItems: aws.Int32(1)}
|
||||
var pages []*iam.ListRolePoliciesOutput
|
||||
for {
|
||||
out, err := listIAMRolePolicies(client, &input)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
pages = append(pages, out)
|
||||
if !out.IsTruncated {
|
||||
break
|
||||
}
|
||||
input.Marker = out.Marker
|
||||
}
|
||||
|
||||
if len(pages) != len(want) {
|
||||
return fmt.Errorf("expected %d pages, instead got %d", len(want), len(pages))
|
||||
}
|
||||
var got []string
|
||||
for i, page := range pages {
|
||||
if len(page.PolicyNames) != 1 {
|
||||
return fmt.Errorf("expected page %d to contain 1 policy, instead got %d", i+1, len(page.PolicyNames))
|
||||
}
|
||||
if page.IsTruncated != (i < len(pages)-1) {
|
||||
return fmt.Errorf("unexpected IsTruncated value on page %d", i+1)
|
||||
}
|
||||
got = append(got, page.PolicyNames...)
|
||||
}
|
||||
slices.Sort(got)
|
||||
if !slices.Equal(got, want) {
|
||||
return fmt.Errorf("expected policy names %v, instead got %v", want, got)
|
||||
}
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMRoleAndPolicies(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func listIAMRolePolicies(client *iam.Client, input *iam.ListRolePoliciesInput) (*iam.ListRolePoliciesOutput, error) {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), shortTimeout)
|
||||
defer cancel()
|
||||
return client.ListRolePolicies(ctx, input)
|
||||
}
|
||||
@@ -0,0 +1,389 @@
|
||||
// Copyright 2026 Versity Software
|
||||
// This file is licensed under the Apache License, Version 2.0
|
||||
// (the "License"); you may not use this file except in compliance
|
||||
// with the License. You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing,
|
||||
// software distributed under the License is distributed on an
|
||||
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
// KIND, either express or implied. See the License for the
|
||||
// specific language governing permissions and limitations
|
||||
// under the License.
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/aws/aws-sdk-go-v2/aws"
|
||||
awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
|
||||
"github.com/aws/aws-sdk-go-v2/service/iam"
|
||||
"github.com/versity/versitygw/iamapi/iamerr"
|
||||
"github.com/versity/versitygw/iamapi/storage"
|
||||
)
|
||||
|
||||
func IAMPutRolePolicy_missing_role_name(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_missing_role_name"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"PutRolePolicy"},
|
||||
"Version": {"2010-05-08"},
|
||||
"PolicyName": {"p"},
|
||||
"PolicyDocument": {validIAMPolicyDocument},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingValue("roleName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMPutRolePolicy_missing_policy_name(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_missing_policy_name"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"PutRolePolicy"},
|
||||
"Version": {"2010-05-08"},
|
||||
"RoleName": {newIAMRoleName()},
|
||||
"PolicyDocument": {validIAMPolicyDocument},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingValue("policyName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMPutRolePolicy_missing_policy_document(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_missing_policy_document"
|
||||
body := []byte(url.Values{
|
||||
"Action": {"PutRolePolicy"},
|
||||
"Version": {"2010-05-08"},
|
||||
"RoleName": {newIAMRoleName()},
|
||||
"PolicyName": {"p"},
|
||||
}.Encode())
|
||||
return authHandler(s, &authConfig{
|
||||
testName: testName,
|
||||
method: http.MethodPost,
|
||||
service: "iam",
|
||||
region: iamAuthRegion,
|
||||
body: body,
|
||||
date: time.Now().UTC(),
|
||||
headers: map[string]string{
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
},
|
||||
}, func(req *http.Request) error {
|
||||
return checkIAMAuthRequest(s, req, iamerr.MissingValue("policyDocument"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMPutRolePolicy_invalid_policy_name(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_invalid_policy_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: aws.String(newIAMRoleName()),
|
||||
PolicyName: aws.String("bad/name"),
|
||||
PolicyDocument: aws.String(validIAMPolicyDocument),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.InvalidUserName("policyName"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMPutRolePolicy_long_policy_name(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_long_policy_name"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: aws.String(newIAMRoleName()),
|
||||
PolicyName: aws.String(strings.Repeat("p", 129)),
|
||||
PolicyDocument: aws.String(validIAMPolicyDocument),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.UserNameTooLong("policyName", 128))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMPutRolePolicy_non_ascii_policy_document(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_non_ascii_policy_document"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
_, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: aws.String(newIAMRoleName()),
|
||||
PolicyName: aws.String("p"),
|
||||
PolicyDocument: aws.String("emoji\U0001F600test"),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.InvalidCharset("policyDocument"))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMPutRolePolicy_non_existing_role(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_non_existing_role"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := "non-existing-" + genRandString(16)
|
||||
_, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("p"),
|
||||
PolicyDocument: aws.String(validIAMPolicyDocument),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.NoSuchEntityRole(roleName))
|
||||
})
|
||||
}
|
||||
|
||||
func IAMPutRolePolicy_malformed_policy_document(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_malformed_policy_document"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
cases := []struct {
|
||||
name string
|
||||
doc string
|
||||
wantErr iamerr.APIError
|
||||
}{
|
||||
{"invalid json syntax", `{not valid json`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
{"empty object", `{}`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
{"invalid version", `{"Version":"2020-01-01","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
{"missing statement", `{"Version":"2012-10-17"}`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
{"null statement", `{"Version":"2012-10-17","Statement":null}`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
{"empty statement array", `{"Version":"2012-10-17","Statement":[]}`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
{"statement is a string", `{"Version":"2012-10-17","Statement":"hello"}`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
{"missing effect", `{"Version":"2012-10-17","Statement":[{"Action":"s3:GetObject","Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
{"invalid effect value", `{"Version":"2012-10-17","Statement":[{"Effect":"Maybe","Action":"s3:GetObject","Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
{"action and notaction both present", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","NotAction":"s3:PutObject","Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
{"resource and notresource both present", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*","NotResource":"foo"}]}`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
{"numeric action wrong type", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":123,"Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Syntax errors in policy.")},
|
||||
|
||||
{"missing action and notaction", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Policy statement must contain actions.")},
|
||||
|
||||
{"missing resource and notresource", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject"}]}`, iamerr.MalformedPolicyDocument("Policy statement must contain resources.")},
|
||||
{"empty resource array", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":[]}]}`, iamerr.MalformedPolicyDocument("Policy statement must contain resources.")},
|
||||
|
||||
{"empty string action", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"","Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Actions/Conditions must be prefaced by a vendor, e.g., iam, sdb, ec2, etc.")},
|
||||
{"action missing vendor colon", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"GetObject","Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Actions/Conditions must be prefaced by a vendor, e.g., iam, sdb, ec2, etc.")},
|
||||
{"notaction missing vendor colon", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","NotAction":"GetObject","Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Actions/Conditions must be prefaced by a vendor, e.g., iam, sdb, ec2, etc.")},
|
||||
{"empty vendor prefix", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":":GetObject","Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Vendor is not valid")},
|
||||
{"vendor with invalid character", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam :Get","Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Vendor iam is not valid")},
|
||||
|
||||
{"resource with no colon at all", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"invalid"}]}`, iamerr.MalformedPolicyDocument(`Resource invalid must be in ARN format or "*".`)},
|
||||
{"notresource with no colon at all", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","NotResource":"invalid"}]}`, iamerr.MalformedPolicyDocument(`Resource invalid must be in ARN format or "*".`)},
|
||||
{"resource with colon but no arn prefix", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"s3::example-bucket/*"}]}`, iamerr.MalformedPolicyDocument(`Partition "" is not valid for resource "arn::example-bucket/*:*:*:*".`)},
|
||||
{"resource with arn prefix but too few fields", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:awss3::example-bucket/*"}]}`, iamerr.MalformedPolicyDocument("The policy failed legacy parsing")},
|
||||
{"resource with invalid partition", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws2:s3:::example-bucket/*"}]}`, iamerr.MalformedPolicyDocument(`Partition "aws2" is not valid for resource "arn:aws2:s3:::example-bucket/*".`)},
|
||||
|
||||
{"duplicate sid across statements", `{"Version":"2012-10-17","Statement":[{"Sid":"Dup","Effect":"Allow","Action":"s3:GetObject","Resource":"*"},{"Sid":"Dup","Effect":"Allow","Action":"s3:PutObject","Resource":"*"}]}`, iamerr.MalformedPolicyDocument("Statement IDs (SID) in a single policy must be unique.")},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
if err := func() error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return fmt.Errorf("%s: %w", c.name, err)
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
_, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("p"),
|
||||
PolicyDocument: aws.String(c.doc),
|
||||
})
|
||||
if err := checkIAMApiErr(err, c.wantErr); err != nil {
|
||||
return fmt.Errorf("%s: %w", c.name, err)
|
||||
}
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMRole(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
}(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
})
|
||||
}
|
||||
|
||||
func IAMPutRolePolicy_principal_not_allowed(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_principal_not_allowed"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
doc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"*"}]}`
|
||||
_, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("p"),
|
||||
PolicyDocument: aws.String(doc),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.MalformedPolicyDocument("Policy document should not specify a principal."))
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMRole(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMPutRolePolicy_limit_exceeded(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_limit_exceeded"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
oversized := `{"Version":"2012-10-17","Statement":[{"Sid":"` + strings.Repeat("x", 10500) + `","Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}`
|
||||
_, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("p"),
|
||||
PolicyDocument: aws.String(oversized),
|
||||
})
|
||||
return checkIAMApiErr(err, iamerr.InlinePolicyQuotaExceeded("role", roleName, storage.MaxInlinePolicyBytesPerRole))
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMRole(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMPutRolePolicy_success(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_success"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
out, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("ReadOnly"),
|
||||
PolicyDocument: aws.String(validIAMPolicyDocument),
|
||||
})
|
||||
checkErr := func() error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if out == nil {
|
||||
return fmt.Errorf("expected PutRolePolicy output")
|
||||
}
|
||||
if requestID, ok := awsmiddleware.GetRequestIDMetadata(out.ResultMetadata); !ok || requestID == "" {
|
||||
return fmt.Errorf("expected PutRolePolicy response request id")
|
||||
}
|
||||
|
||||
got, err := getIAMRolePolicy(client, &iam.GetRolePolicyInput{RoleName: &roleName, PolicyName: aws.String("ReadOnly")})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
gotDocument, err := url.QueryUnescape(aws.ToString(got.PolicyDocument))
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to url-decode policy document %q: %w", aws.ToString(got.PolicyDocument), err)
|
||||
}
|
||||
if gotDocument != validIAMPolicyDocument {
|
||||
return fmt.Errorf("expected policy document %q, instead got %q", validIAMPolicyDocument, gotDocument)
|
||||
}
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMRoleAndPolicies(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func IAMPutRolePolicy_overwrite_updates_existing(s *S3Conf) error {
|
||||
testName := "IAMPutRolePolicy_overwrite_updates_existing"
|
||||
return iamActionHandler(s, testName, func(client *iam.Client) error {
|
||||
roleName := newIAMRoleName()
|
||||
if _, err := createIAMRole(client, &iam.CreateRoleInput{
|
||||
RoleName: &roleName,
|
||||
AssumeRolePolicyDocument: aws.String(validTrustPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
checkErr := func() error {
|
||||
if _, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("p"),
|
||||
PolicyDocument: aws.String(validIAMPolicyDocument),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
updated := `{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"s3:DeleteObject","Resource":"*"}]}`
|
||||
if _, err := putIAMRolePolicy(client, &iam.PutRolePolicyInput{
|
||||
RoleName: &roleName,
|
||||
PolicyName: aws.String("p"),
|
||||
PolicyDocument: aws.String(updated),
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
got, err := getIAMRolePolicy(client, &iam.GetRolePolicyInput{RoleName: &roleName, PolicyName: aws.String("p")})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
gotDocument, err := url.QueryUnescape(aws.ToString(got.PolicyDocument))
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to url-decode policy document %q: %w", aws.ToString(got.PolicyDocument), err)
|
||||
}
|
||||
if gotDocument != updated {
|
||||
return fmt.Errorf("expected overwritten policy document %q, instead got %q", updated, gotDocument)
|
||||
}
|
||||
return nil
|
||||
}()
|
||||
|
||||
deleteErr := deleteIAMRoleAndPolicies(client, roleName)
|
||||
if checkErr != nil {
|
||||
return checkErr
|
||||
}
|
||||
return deleteErr
|
||||
})
|
||||
}
|
||||
|
||||
func putIAMRolePolicy(client *iam.Client, input *iam.PutRolePolicyInput) (*iam.PutRolePolicyOutput, error) {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), shortTimeout)
|
||||
defer cancel()
|
||||
return client.PutRolePolicy(ctx, input)
|
||||
}
|
||||
Reference in New Issue
Block a user