niksis02 aa1e82b66c fix: require s3:PutObjectTagging for tagged browser-based POST object uploads ...

`POSTObject` authorized only `s3:PutObject`, even when the form's `tagging` field set tags on the uploaded object. `PutObject`, `CopyObject` and `CreateMultipartUpload` also require `s3:PutObjectTagging` when tags are sent, so a caller without that permission could tag objects through `POST` in a way `PutObject` refuses. S3 enforces the permission for `POST` too: a user granted only `s3:PutObject` gets `AccessDenied` for `s3:PutObjectTagging` on the object ARN.

`POSTObject` now adds `s3:PutObjectTagging` to the `verifyAccess` actions when the parsed tag set is not empty, in the same single check as `s3:PutObject`, matching `PutObject`. A `tagging` field with an empty `TagSet` still needs only `s3:PutObject`, as on S3.

The access check now runs after the form is validated, instead of before the `POST` policy is parsed. S3 validates the policy and its conditions, the tagging, the checksum fields, the metadata size and the website redirect location before it authorizes the upload, so a caller missing a permission now gets the validation error for an invalid form instead of `AccessDenied`.

2026-09-24 22:31:08 +04:00

..

AbortMultipartUpload.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

Access_Control.go

feat: add s3:if-match and s3:if-none-match policy condition keys

2026-09-09 17:18:42 +04:00

bench.go

chore: run go modernize tool

2026-03-10 09:47:37 -07:00

CompleteMultipartUpload.go

feat: add optional data-integrity ETag mode for posix/scoutfs

2026-07-31 14:58:21 -07:00

concurrency.go

test: add github actions functional tests for posix sidecar option

2026-04-22 13:23:46 -07:00

CopyObject.go

feat(azure): server-side copy with download+reupload fallback

2026-08-27 16:37:28 -07:00

CreateBucket.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

CreateMultipartUpload.go

feat: support x-amz-website-redirect-location

2026-06-10 12:41:55 +04:00

data-io.go

chore: add missing copyright headers to files

2024-05-06 16:16:31 -07:00

DeleteBucket.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

DeleteBucketCors.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketOwnershipControls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketPolicy.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketTagging.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

DeleteBucketWebsite.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

DeleteObject.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

DeleteObjects.go

fix: reject DeleteObjects requests with more than 1000 keys

2026-09-24 08:22:36 -07:00

DeleteObjectTagging.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

general.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

GetBucketAcl.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketCors.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketLocation.go

fix: return null in GetBucketLocation for us-east-1

2026-01-05 16:24:01 +04:00

GetBucketLockConfiguration.go

fix: omit ObjectLockConfiguration Rule when there is no default retention

2026-09-16 08:16:55 -07:00

GetBucketOwnershipControls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketPolicy.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketPolicyStatus.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketTagging.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketVersioning.go

feat: govern GetBucketVersioning with the regular access checks

2026-08-31 16:47:49 +04:00

GetBucketWebsite.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

GetObject.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

GetObjectAttributes.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

GetObjectLegalHold.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

GetObjectRetention.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

GetObjectTagging.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

group-tests.go

fix: require s3:PutObjectTagging for tagged browser-based POST object uploads

2026-09-24 22:31:08 +04:00

HeadBucket.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

HeadObject.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

iam_access_control.go

feat: add OIDC endpoint relaxations for private/isolated networks

2026-09-08 16:30:37 +04:00

iam_add_client_id_to_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_assume_role_with_web_identity.go

feat: add OIDC endpoint relaxations for private/isolated networks

2026-09-08 16:30:37 +04:00

iam_auth.go

feat: add AWS-compatible standalone IAM service

2026-08-25 01:03:12 +04:00

iam_create_access_key.go

fix: infer UserName from the calling access key in the access-key APIs

2026-09-02 16:15:53 +04:00

iam_create_oidc_provider.go

feat: add OIDC endpoint relaxations for private/isolated networks

2026-09-08 16:30:37 +04:00

iam_create_role.go

fix: role last-used tracking, and record S3 requests in last-used metadata

2026-09-01 19:55:27 +04:00

iam_create_user.go

feat: add IAM Role CRUD

2026-08-25 01:03:22 +04:00

iam_delete_access_key.go

fix: infer UserName from the calling access key in the access-key APIs

2026-09-02 16:15:53 +04:00

iam_delete_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_delete_role_policy.go

feat: add IAM role inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_delete_role.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_delete_user_policy.go

feat: add IAM user inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_delete_user.go

feat: add IAM user access key management

2026-08-25 01:03:22 +04:00

iam_get_access_key_last_used.go

feat: add IAM user access key management

2026-08-25 01:03:22 +04:00

iam_get_caller_identity.go

feat: add STS web identity federation, IAM policy Condition support, and access control enforcement

2026-08-25 01:06:25 +04:00

iam_get_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_get_role_policy.go

feat: add IAM role inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_get_role.go

fix: role last-used tracking, and record S3 requests in last-used metadata

2026-09-01 19:55:27 +04:00

iam_get_user_policy.go

feat: add IAM user inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_get_user.go

feat: add AWS-compatible standalone IAM service

2026-08-25 01:03:12 +04:00

iam_list_access_keys.go

fix: infer UserName from the calling access key in the access-key APIs

2026-09-02 16:15:53 +04:00

iam_list_oidc_provider_tags.go

feat: add IAM OIDC provider tagging actions

2026-08-28 00:49:21 +04:00

iam_list_oidc_providers.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_list_role_policies.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_role_tags.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_list_roles.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_user_policies.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_user_tags.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_users.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_put_role_policy.go

feat: add IAM role inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_put_user_policy.go

feat: add IAM user inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_query_auth.go

feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement

2026-08-25 01:07:36 +04:00

iam_remove_client_id_from_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_tag_oidc_provider.go

feat: add IAM OIDC provider tagging actions

2026-08-28 00:49:21 +04:00

iam_tag_role.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_tag_user.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_untag_oidc_provider.go

feat: add IAM OIDC provider tagging actions

2026-08-28 00:49:21 +04:00

iam_untag_role.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_untag_user.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_update_access_key.go

fix: infer UserName from the calling access key in the access-key APIs

2026-09-02 16:15:53 +04:00

iam_update_assume_role_policy.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_update_oidc_provider_thumbprint.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_update_user.go

feat: add AWS-compatible standalone IAM service

2026-08-25 01:03:12 +04:00

iam.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

ListBuckets.go

feat: add windows functional test coverage and fix some windows behavior

2026-06-18 11:34:05 -07:00

ListMultipartUploads.go

fix: make ListMultipartUploads ordering deterministic and stabilize test timing

2026-09-08 20:23:09 +04:00

ListObjects.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

ListObjectsV2.go

feat(azure): carry Azure blob marker in continuation token for pagination

2026-08-27 16:40:43 -07:00

ListObjectVersions.go

fix: place the null version by its recorded position in posix versioning

2026-09-24 16:58:30 +04:00

ListParts.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

no_acl.go

feat: revert ignore object ACL behavior

2026-03-02 19:30:57 +04:00

NotImplemented_actions.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

OPTIONS.go

feat: add option for default global cors allow origin headers

2026-01-08 16:23:23 -08:00

output.go

feat: add live GitHub OIDC end-to-end test for AssumeRoleWithWebIdentity

2026-08-25 01:07:33 +04:00

posix.go

fix: stop posix mixing up keys that differ only by a trailing slash

2026-09-19 22:26:47 +04:00

PostObject.go

fix: require s3:PutObjectTagging for tagged browser-based POST object uploads

2026-09-24 22:31:08 +04:00

presigned_urls.go

fix: strip aws-chunked when the request declares no payload type

2026-09-22 02:05:00 +04:00

public_bucket.go

fix: authorize browser-based POST object uploads against the object ARN

2026-09-23 22:53:54 +04:00

PutBucketAcl.go

fix: adds validation for bucket canned ACL

2025-11-03 22:59:06 +04:00

PutBucketCors.go

fix: fixes PutBucketCors CORSRules validation

2026-02-24 16:59:38 +04:00

PutBucketOwnershipControls.go

fix: fix empty ownership control rules panic

2026-05-23 04:18:06 +04:00

PutBucketPolicy.go

feat: add s3:if-match and s3:if-none-match policy condition keys

2026-09-09 17:18:42 +04:00

PutBucketTagging.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

PutBucketVersioning.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

PutBucketWebsite.go

fix: return InvalidArgument for an empty website configuration

2026-09-20 11:04:22 -07:00

PutObject.go

fix: match S3's Content-Encoding error details for aws-chunked with UNSIGNED-PAYLOAD

2026-09-22 02:04:34 +04:00

PutObjectLegalHold.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

PutObjectLockConfiguration.go

fix: validate object lock default retention upper limits

2026-06-16 22:48:51 +04:00

PutObjectRetention.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

PutObjectTagging.go

fix: reject empty versionId query parameter in object actions

2026-09-10 16:35:05 +04:00

s3_iam_access_control.go

fix: require s3:PutObjectTagging for tagged browser-based POST object uploads

2026-09-24 22:31:08 +04:00

s3_iam_principals.go

feat: accept principal ARNs in bucket policies under standalone IAM

2026-09-03 23:51:55 +04:00

s3_iam_session_access_control.go

feat: accept principal ARNs in bucket policies under standalone IAM

2026-09-03 23:51:55 +04:00

s3_iam_utils.go

fix: require s3:PutObjectTagging for tagged browser-based POST object uploads

2026-09-24 22:31:08 +04:00

s3conf.go

tests: build the integration SDK config without the host's AWS setup

2026-09-08 07:21:40 -07:00

server.go

feat: migrate Fiber to v3.3.0

2026-06-15 14:48:31 +04:00

signed_streaming_payload_trailer.go

feat: support sha512, md5, xxhash3, xxhash64, xxhash128 data integrity checksums

2026-05-04 08:50:39 -07:00

signed_streaming_payload.go

feat: adds integration tests for STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER requests

2025-12-26 21:16:01 +04:00

sigv4_auth.go

fix: align signing region mismatch errors with s3 regional endpoints

2026-09-23 14:41:29 +04:00

unsigned_streaming_payload_trailer.go

fix: match S3's Content-Encoding error details for aws-chunked with UNSIGNED-PAYLOAD

2026-09-22 02:04:34 +04:00

UploadPart.go

fix: use content-legnth for PutObject and UploadPart allocation sizes

2026-09-20 11:46:23 -07:00

UploadPartCopy.go

feat: add optional data-integrity ETag mode for posix/scoutfs

2026-07-31 14:58:21 -07:00

utils.go

Merge pull request #2431 from versity/sis/region-mismatch-error-parity

2026-09-24 07:58:19 -07:00

versioning.go

fix: place the null version by its recorded position in posix versioning

2026-09-24 16:58:30 +04:00

WebsiteHosting.go

Bugfix: url-encoded chars on the website listener

2026-08-19 13:54:34 +02:00

WORM_protection.go

fix: enforce object lock on browser-based POST object uploads

2026-09-23 18:13:25 +04:00