auth

package
v1.10.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 22, 2026 License: Apache-2.0 Imports: 50 Imported by: 2

Documentation

Index

Constants

View Source 
const IpaVersion = "2.254"
View Source 
const ResourceArnPrefix = "arn:aws:s3:::"

Variables

View Source 
var (
	// ErrUserExists is returned when the user already exists
	ErrUserExists = errors.New("user already exists")
	// ErrNoSuchUser is returned when the user does not exist
	ErrNoSuchUser = errors.New("user not found")
	// ErrInvalidSessionToken is returned when a request's
	// X-Amz-Security-Token is missing for a temporary (ASIA…) access key,
	// doesn't match the session that key belongs to, or is present
	// alongside a permanent credential. Callers render it as S3's
	// InvalidToken, distinct from the InvalidAccessKeyId that ErrNoSuchUser
	// produces — matching real S3, which reports the two separately.
	ErrInvalidSessionToken = errors.New("invalid session token")
)

Functions

func CheckObjectAccess 

func CheckObjectAccess(ctx fiber.Ctx, bucket string, acc Account, objects []types.ObjectIdentifier, bypass BypassMode, isBucketPublic bool, be backend.Backend, iam IAMService, isOverwrite bool) error

CheckObjectAccess enforces the object locks protecting objects, for the single-object write paths. The multi-object delete path uses VerifyObjectsAccess instead, which folds this together with the authorization check into one pass.

func IsObjectLockRetentionPutAllowed added in v1.0.19 

func IsObjectLockRetentionPutAllowed(ctx fiber.Ctx, be backend.Backend, iam IAMService, bucket, object, versionId string, acc Account, input *s3response.PutObjectRetentionInput, bypass bool) error

IsObjectLockRetentionPutAllowed checks if the object lock retention PUT request is allowed against the current state of the object lock

func ParseBucketLockConfigurationInput 

func ParseBucketLockConfigurationInput(input []byte) ([]byte, error)

func ParseBucketLockConfigurationOutput 

func ParseBucketLockConfigurationOutput(input []byte) (*types.ObjectLockConfiguration, error)

func ParseObjectLegalHoldOutput 

func ParseObjectLegalHoldOutput(status *bool) *s3response.GetObjectLegalHoldResult

func ParseObjectLockRetentionInput 

func ParseObjectLockRetentionInput(input []byte) (*s3response.PutObjectRetentionInput, error)

func ParseObjectLockRetentionInputToJSON added in v1.0.19 

func ParseObjectLockRetentionInputToJSON(input *s3response.PutObjectRetentionInput) ([]byte, error)

func ParseObjectLockRetentionOutput 

func ParseObjectLockRetentionOutput(input []byte) (*types.ObjectLockRetention, error)

func UpdateACL 

func UpdateACL(input *PutBucketAclInput, acl ACL, iam IAMService) ([]byte, error)

func UpdateBucketACLOwner added in v1.0.16 

func UpdateBucketACLOwner(ctx context.Context, be backend.Backend, bucket, newOwner string) error

UpdateBucketACLOwner sets default ACL with new owner and removes any previous bucket policy that was in place

func ValidateCannedACL added in v1.0.19 

func ValidateCannedACL(acl types.BucketCannedACL) error

ValidateCannedACL validates bucket canned acl value

func ValidatePolicyDocument 

func ValidatePolicyDocument(policyBin []byte, bucket string, iam IAMService) error

func VerifyAccess 

func VerifyAccess(ctx fiber.Ctx, be backend.Backend, opts AccessOptions) error

VerifyAccess decides whether opts.Acc may perform opts.Actions against opts.Bucket/opts.Object, combining the bucket's own resource-based decision (its policy and ACL) with an identity-based decision from opts.Iam when it implements PolicyEvaluator. An explicit Deny from either source denies the request outright, even when the other source would otherwise allow it; absent any explicit Deny, each action is allowed by either source's Allow on its own, and the request needs every action allowed. All three denial shapes are Code: AccessDenied, HTTP 403 — differing only in the dynamic Message text.

func VerifyCreateBucketAccess added in v1.8.0 

func VerifyCreateBucketAccess(ctx fiber.Ctx, iam IAMService, isRoot bool, acc Account, bucket string) error

VerifyCreateBucketAccess decides whether acc may create a bucket named bucket. Unlike VerifyAccess, the bucket doesn't exist yet at this point, so there is no bucket policy or ACL to consult — root/admin always bypass, and otherwise authorization comes from whichever mechanism the configured iam backend actually supports: for backends that implement PolicyEvaluator (currently only the standalone IAM service client), an identity-policy Allow for s3:CreateBucket grants access, exactly like any other IAM-policy-gated action; the legacy userplus-role bypass applies only to backends with no such policy layer (internal/LDAP/Vault/IPA/S3-IAM), since those have no other way to grant a plain "user" account this permission.

func VerifyListAllMyBucketsAccess added in v1.8.0 

func VerifyListAllMyBucketsAccess(ctx fiber.Ctx, iam IAMService, isRoot bool, acc Account) error

VerifyListAllMyBucketsAccess decides whether acc may list buckets. The request names no bucket, so only identity policies apply: an Allow for s3:ListAllMyBuckets on "arn:aws:s3:::*", the ARN AWS's own bucket-listing policy names. Backends with no identity-policy layer already narrow the listing to the caller's own buckets, so they need no permission of their own.

func VerifyObjectCopyAccess 

func VerifyObjectCopyAccess(ctx fiber.Ctx, be backend.Backend, copySource string, opts AccessOptions) error

func VerifyObjectsAccess added in v1.8.0 

func VerifyObjectsAccess(ctx fiber.Ctx, be backend.Backend, opts AccessOptions, objects []types.ObjectIdentifier, bypass BypassMode) ([]error, error)

VerifyObjectsAccess authorizes a multi-object delete — the parsed contents of a DeleteObjects request body, passed straight through. It answers, for every object independently, whether policy allows deleting it and whether an object lock protects it, in a single pass. DeleteObjects supports partial success — unlike every other write path — so a denial on one object must not affect any other: the caller sends only the objects that pass through to the backend, and reports the rest as per-object errors straight from the returned slice.

Both halves are deliberately here rather than split across the caller: the per-object work needs one loop, not one loop per concern at a different layer, and the expensive parts of each half — the bucket policy, the batched identity-policy round trip, the bucket's lock configuration — are resolved once up front for the whole request.

Every key is authorized against its own object ARN, the way real AWS does it: a policy granting s3:DeleteObject on "arn:aws:s3:::bucket/*" and nothing else deletes successfully. An object named with a VersionId is authorized against s3:DeleteObjectVersion instead of s3:DeleteObject, the same split the single-object DELETE path already makes: a policy granting only s3:DeleteObject denies the versioned deletes in the same batch that its keyed deletes succeed under, and the batch's response reports that denial on just that object, the rest unaffected.

The returned slice has one entry per object: nil where that object may proceed, an AWS-shaped denial otherwise. opts.Object and opts.Actions are both ignored in favor of objects. The second return is non-nil only for a failure that isn't about any one object — readonly mode, or an error resolving the bucket's policy or lock configuration — and fails the whole request, matching what a hard failure did before this returned per-object results at all.

func VerifyPublicAccess added in v1.0.15 

func VerifyPublicAccess(ctx fiber.Ctx, be backend.Backend, actions []Action, permission Permission, bucket, object string) error

VerifyPublicAccess checks that the bucket grants every one of actions to anonymous requesters. Each action is granted on its own, by the bucket policy or, failing that, the bucket ACL, and the request needs them all: a tagged upload to a public-read-write bucket whose policy publicly grants s3:PutObjectTagging is allowed, the ACL granting its s3:PutObject. An explicit public Deny of any one action denies the request, whatever the ACL grants.

func VerifyPublicBucketACL added in v1.0.15 

func VerifyPublicBucketACL(ctx context.Context, be backend.Backend, bucket string, permission Permission) error

Verifies if the bucket acl grants public access

func VerifyPublicBucketPolicy added in v1.0.15 

func VerifyPublicBucketPolicy(policy []byte, bucket, object string, condCtx map[string][]string, normalizeObjectKey objectKeyNormalizer, action Action) error

Checks if the bucket policy grants public access

func VerifyWriteObjectLock added in v1.9.0 

func VerifyWriteObjectLock(ctx context.Context, be backend.Backend, bucket string, explicit bool) (bool, error)

VerifyWriteObjectLock checks the Object Lock parameters an object write carries against its bucket, and reports whether it carries any. explicit is whether the request sets them itself: a legal hold of either status, or a retention mode and date. Those are rejected on a bucket without Object Lock. A write that sets none still carries the ones a default retention rule gives every object written to the bucket.

Types

type ACL 

type ACL struct {
	Owner    string
	Grantees []Grantee
}

func ParseACL 

func ParseACL(data []byte) (ACL, error)

func (*ACL) IsPublic added in v1.0.15 

func (acl *ACL) IsPublic(permission Permission) bool

IsPublic specifies if the acl grants public read access

type AccessControlList 

type AccessControlList struct {
	Grants []Grant `xml:"Grant"`
}

type AccessControlPolicy 

type AccessControlPolicy struct {
	AccessControlList AccessControlList `xml:"AccessControlList"`
	Owner             *types.Owner
}

func (*AccessControlPolicy) Validate added in v1.0.10 

func (acp *AccessControlPolicy) Validate() error

type AccessOptions 

type AccessOptions struct {
	Acl             ACL
	AclPermission   Permission
	IsRoot          bool
	Acc             Account
	Bucket          string
	Object          string
	Actions         []Action
	Readonly        bool
	IsPublicRequest bool
	DisableACL      bool
	Iam             IAMService
}

type Account 

type Account struct {
	Access    string `json:"access"`
	Secret    string `json:"secret"`
	Role      Role   `json:"role"`
	UserID    int    `json:"userID"`
	GroupID   int    `json:"groupID"`
	ProjectID int    `json:"projectID"`

	// SessionToken and IsSession describe a temporary credential minted by
	// AssumeRoleWithWebIdentity, and are set only by the S3 auth
	// middlewares for the duration of one request. They ride on Account
	// rather than on auth.AccessOptions so the ~55 controller sites that
	// already forward the request's Account into an authorization check
	// carry them without a single edit.
	//
	// Both are json:"-": a session is request state, never persisted by an
	// IAM backend nor echoed by the admin API.
	SessionToken string `json:"-"`
	IsSession    bool   `json:"-"`

	// Arn and RoleArn name this account the way a bucket policy's Principal
	// element does, and are set only by IAM backends whose identities have
	// ARNs at all — currently just the standalone IAM service client. Arn is
	// the caller's own ARN (an IAM user's, or a session's
	// arn:aws:sts::…:assumed-role/<role>/<session>); RoleArn is the ARN of
	// the role a session assumed, and is empty for everything else.
	//
	// Both are needed to match a session, because a Principal naming a role
	// matches every session of that role while one naming a session matches
	// only that session. When Arn is empty the gateway matches principals by
	// access key id instead, which is what every other backend has always
	// done — see Principals.matchFor.
	Arn     string `json:"-"`
	RoleArn string `json:"-"`
}

Account is a gateway IAM account

func ResolveDerivedKey added in v1.8.0 

func ResolveDerivedKey(iam IAMService, root Account, access, sessionToken, date, region, service string) ([]byte, Account, error)

ResolveDerivedKey resolves access's SigV4 derived signing key (kSigning) and account metadata for date/region/service. root is special-cased locally — its secret is already known to this process either way, so there's no reason to round-trip it through iam. Otherwise, if iam implements SigningKeyProvider, the key is fetched from it directly and the account's secret never enters this process; otherwise iam's account is resolved via GetUserAccount and the key is derived locally from its secret, preserving today's behavior for every backend that doesn't implement SigningKeyProvider (internal, LDAP, Vault, IPA, S3).

sessionToken is the request's X-Amz-Security-Token, or "" when it carries none. A temporary (ASIA…) access key, or a token paired with a permanent one, is only meaningful to a SigningKeyProvider backend: no other backend can mint a session, so for them either shape is rejected as ErrInvalidSessionToken rather than silently resolving to something else.

func ResolveFixedBucketOwner added in v1.8.0 

func ResolveFixedBucketOwner(iam IAMService) (Account, bool)

ResolveFixedBucketOwner reports the account that owns every bucket when iam fixes ownership, and false when ownership follows the creator instead.

func (Account) String added in v1.8.0 

func (a Account) String() string

String elides the two credential-bearing fields so an Account can't leak them into a log line through a %v/%+v verb. debuglogger redacts the X-Amz-Security-Token *header*, which does nothing for a struct printed after the token has been parsed out of it.

type Action 

type Action string
const (
	GetBucketAclAction                       Action = "s3:GetBucketAcl"
	CreateBucketAction                       Action = "s3:CreateBucket"
	PutBucketAclAction                       Action = "s3:PutBucketAcl"
	DeleteBucketAction                       Action = "s3:DeleteBucket"
	PutBucketVersioningAction                Action = "s3:PutBucketVersioning"
	GetBucketVersioningAction                Action = "s3:GetBucketVersioning"
	PutBucketPolicyAction                    Action = "s3:PutBucketPolicy"
	GetBucketPolicyAction                    Action = "s3:GetBucketPolicy"
	DeleteBucketPolicyAction                 Action = "s3:DeleteBucketPolicy"
	AbortMultipartUploadAction               Action = "s3:AbortMultipartUpload"
	ListMultipartUploadPartsAction           Action = "s3:ListMultipartUploadParts"
	ListBucketMultipartUploadsAction         Action = "s3:ListBucketMultipartUploads"
	PutObjectAction                          Action = "s3:PutObject"
	GetObjectAction                          Action = "s3:GetObject"
	GetObjectVersionAction                   Action = "s3:GetObjectVersion"
	DeleteObjectAction                       Action = "s3:DeleteObject"
	DeleteObjectVersionAction                Action = "s3:DeleteObjectVersion"
	GetObjectAclAction                       Action = "s3:GetObjectAcl"
	GetObjectAttributesAction                Action = "s3:GetObjectAttributes"
	GetObjectVersionAttributesAction         Action = "s3:GetObjectVersionAttributes"
	PutObjectAclAction                       Action = "s3:PutObjectAcl"
	RestoreObjectAction                      Action = "s3:RestoreObject"
	GetBucketTaggingAction                   Action = "s3:GetBucketTagging"
	PutBucketTaggingAction                   Action = "s3:PutBucketTagging"
	GetObjectTaggingAction                   Action = "s3:GetObjectTagging"
	GetObjectVersionTaggingAction            Action = "s3:GetObjectVersionTagging"
	PutObjectTaggingAction                   Action = "s3:PutObjectTagging"
	PutObjectVersionTaggingAction            Action = "s3:PutObjectVersionTagging"
	DeleteObjectTaggingAction                Action = "s3:DeleteObjectTagging"
	DeleteObjectVersionTaggingAction         Action = "s3:DeleteObjectVersionTagging"
	ListBucketVersionsAction                 Action = "s3:ListBucketVersions"
	ListBucketAction                         Action = "s3:ListBucket"
	GetBucketObjectLockConfigurationAction   Action = "s3:GetBucketObjectLockConfiguration"
	PutBucketObjectLockConfigurationAction   Action = "s3:PutBucketObjectLockConfiguration"
	GetObjectLegalHoldAction                 Action = "s3:GetObjectLegalHold"
	PutObjectLegalHoldAction                 Action = "s3:PutObjectLegalHold"
	GetObjectRetentionAction                 Action = "s3:GetObjectRetention"
	PutObjectRetentionAction                 Action = "s3:PutObjectRetention"
	BypassGovernanceRetentionAction          Action = "s3:BypassGovernanceRetention"
	PutBucketOwnershipControlsAction         Action = "s3:PutBucketOwnershipControls"
	GetBucketOwnershipControlsAction         Action = "s3:GetBucketOwnershipControls"
	PutBucketCorsAction                      Action = "s3:PutBucketCORS"
	GetBucketCorsAction                      Action = "s3:GetBucketCORS"
	PutAnalyticsConfigurationAction          Action = "s3:PutAnalyticsConfiguration"
	GetAnalyticsConfigurationAction          Action = "s3:GetAnalyticsConfiguration"
	PutEncryptionConfigurationAction         Action = "s3:PutEncryptionConfiguration"
	GetEncryptionConfigurationAction         Action = "s3:GetEncryptionConfiguration"
	PutIntelligentTieringConfigurationAction Action = "s3:PutIntelligentTieringConfiguration"
	GetIntelligentTieringConfigurationAction Action = "s3:GetIntelligentTieringConfiguration"
	PutInventoryConfigurationAction          Action = "s3:PutInventoryConfiguration"
	GetInventoryConfigurationAction          Action = "s3:GetInventoryConfiguration"
	PutLifecycleConfigurationAction          Action = "s3:PutLifecycleConfiguration"
	GetLifecycleConfigurationAction          Action = "s3:GetLifecycleConfiguration"
	PutBucketLoggingAction                   Action = "s3:PutBucketLogging"
	GetBucketLoggingAction                   Action = "s3:GetBucketLogging"
	PutBucketRequestPaymentAction            Action = "s3:PutBucketRequestPayment"
	GetBucketRequestPaymentAction            Action = "s3:GetBucketRequestPayment"
	PutMetricsConfigurationAction            Action = "s3:PutMetricsConfiguration"
	GetMetricsConfigurationAction            Action = "s3:GetMetricsConfiguration"
	PutReplicationConfigurationAction        Action = "s3:PutReplicationConfiguration"
	GetReplicationConfigurationAction        Action = "s3:GetReplicationConfiguration"
	PutBucketPublicAccessBlockAction         Action = "s3:PutBucketPublicAccessBlock"
	GetBucketPublicAccessBlockAction         Action = "s3:GetBucketPublicAccessBlock"
	PutBucketNotificationAction              Action = "s3:PutBucketNotification"
	GetBucketNotificationAction              Action = "s3:GetBucketNotification"
	PutAccelerateConfigurationAction         Action = "s3:PutAccelerateConfiguration"
	GetAccelerateConfigurationAction         Action = "s3:GetAccelerateConfiguration"
	PutBucketWebsiteAction                   Action = "s3:PutBucketWebsite"
	GetBucketWebsiteAction                   Action = "s3:GetBucketWebsite"
	DeleteBucketWebsiteAction                Action = "s3:DeleteBucketWebsite"
	GetBucketPolicyStatusAction              Action = "s3:GetBucketPolicyStatus"
	GetBucketLocationAction                  Action = "s3:GetBucketLocation"
	PutObjectAnnotationAction                Action = "s3:PutObjectAnnotation"
	GetObjectAnnotationAction                Action = "s3:GetObjectAnnotation"
	ListObjectAnnotationsAction              Action = "s3:ListObjectAnnotations"
	DeleteObjectAnnotationAction             Action = "s3:DeleteObjectAnnotation"
	// s3:ListAllMyBuckets may appear only in iam user/role
	// policies, so it doesn't appear in supportedActionList and
	// it can never be used in bucket policy documents
	ListAllMyBucketsAction Action = "s3:ListAllMyBuckets"

	AllActions Action = "s3:*"
)

func ObjectUploadActions added in v1.9.0 

func ObjectUploadActions(tagging, legalHold, lockMode, retainUntilDate string) []Action

ObjectUploadActions returns the actions an object upload is authorized as: s3:PutObject, plus one more for each attribute it sets on the object. A non-empty tag set takes s3:PutObjectTagging, a legal hold s3:PutObjectLegalHold whatever its status, and a retention mode or date s3:PutObjectRetention.

func (Action) IsObjectAction 

func (a Action) IsObjectAction() *bool

Checks if the action is object action nil points to 's3:*'

func (Action) IsValid 

func (a Action) IsValid() error

Validates Action: it should either wildcard match with supported actions list or be in it

func (Action) Match added in v1.0.18 

func (a Action) Match(pattern Action) bool

Match wildcard matches the given pattern to the action

func (Action) String added in v1.0.18 

func (a Action) String() string

String converts the action to string

type Actions 

type Actions map[Action]struct{}

func (Actions) Add 

func (a Actions) Add(str string) error

Validates and adds a new Action to Actions map

func (Actions) FindMatch 

func (a Actions) FindMatch(action Action) bool

FindMatch tries to match the given action to the actions list

func (*Actions) UnmarshalJSON 

func (a *Actions) UnmarshalJSON(data []byte) error

Override UnmarshalJSON method to decode both []string and string properties

type Base64Encoded added in v1.0.10 

type Base64Encoded []byte

e.g. 

"value": "aGVsbG93b3JsZAo="

func (*Base64Encoded) UnmarshalJSON added in v1.0.10 

func (b *Base64Encoded) UnmarshalJSON(data []byte) error

type Base64EncodedWrapped added in v1.0.10 

type Base64EncodedWrapped []byte

e.g. 

"value" {
	"__base64__": "aGVsbG93b3JsZAo="
 }

func (*Base64EncodedWrapped) MarshalJSON added in v1.0.10 

func (b *Base64EncodedWrapped) MarshalJSON() ([]byte, error)

func (*Base64EncodedWrapped) UnmarshalJSON added in v1.0.10 

func (b *Base64EncodedWrapped) UnmarshalJSON(data []byte) error

type BucketLockConfig 

type BucketLockConfig struct {
	Enabled          bool
	DefaultRetention *types.DefaultRetention
}

func (BucketLockConfig) DefaultObjectRetention added in v1.9.0 

func (c BucketLockConfig) DefaultObjectRetention(written time.Time) *types.ObjectLockRetention

DefaultObjectRetention returns the retention the bucket's default rule gives an object written at the given time, or nil when there is no rule. It is stored on the object as if the write had requested it, so changing or removing the rule later leaves the object's retention as it is. A rule without a period, which S3 rejects, gives none.

type BucketPolicy 

type BucketPolicy struct {
	Version   PolicyVersion      `json:"Version"`
	Statement []BucketPolicyItem `json:"Statement"`
}

func ParsePolicyDocument added in v1.0.17 

func ParsePolicyDocument(data []byte) (*BucketPolicy, error)

ParsePolicyDocument parses raw bytes to 'BucketPolicy'

func (*BucketPolicy) IsPublic added in v1.0.17 

func (bp *BucketPolicy) IsPublic() bool

IsPublic checks if one of bucket policy statments grant public access to ALL users

func (*BucketPolicy) UnmarshalJSON added in v1.0.13 

func (bp *BucketPolicy) UnmarshalJSON(data []byte) error

func (*BucketPolicy) Validate 

func (bp *BucketPolicy) Validate(bucket string, iam IAMService) error

type BucketPolicyAccessType 

type BucketPolicyAccessType string
const (
	BucketPolicyAccessTypeDeny  BucketPolicyAccessType = "Deny"
	BucketPolicyAccessTypeAllow BucketPolicyAccessType = "Allow"
)

func (BucketPolicyAccessType) Validate 

func (bpat BucketPolicyAccessType) Validate() error

Checks policy statement Effect to be valid ("Deny", "Allow")

type BucketPolicyItem 

type BucketPolicyItem struct {
	Effect     BucketPolicyAccessType `json:"Effect"`
	Principals Principals             `json:"Principal"`
	Actions    Actions                `json:"Action"`
	Resources  Resources              `json:"Resource"`
	Condition  json.RawMessage        `json:"Condition,omitempty"`
}

func (*BucketPolicyItem) Validate 

func (bpi *BucketPolicyItem) Validate(bucket string, iam IAMService) error

type BypassMode added in v1.8.0 

type BypassMode int

BypassMode says whether, and on whose authority, a request may override a GOVERNANCE-mode retention. It exists because the two ways that can happen are not equivalent, and collapsing them into one boolean previously let root overwrite locked objects it should not have been able to. 

const (
	// BypassNone is a request that has not asked to override anything: any
	// unexpired retention blocks it outright.
	BypassNone BypassMode = iota

	// BypassRequested is a request carrying x-amz-bypass-governance-retention
	// — DeleteObject, DeleteObjects, or PutObjectRetention. Root and admin
	// may always override a GOVERNANCE retention this way, matching real
	// AWS, where the account root can bypass regardless of policy; everyone
	// else needs s3:BypassGovernanceRetention.
	BypassRequested

	// BypassOverwrite is the gateway's own extension: replacing an existing
	// governance-locked object via PutObject, CopyObject or POST Object,
	// none of which has a bypass header for a client to send. Because the
	// caller never asked to override anything, the permission is required
	// from everyone here — root included — and root's blanket bypass above
	// deliberately does not apply. (Real S3 has no analogue: it only allows
	// object lock on versioned buckets, where an overwrite creates a new
	// version rather than replacing a locked one.)
	BypassOverwrite
)

func BypassModeForRequest added in v1.8.0 

func BypassModeForRequest(headerPresent bool) BypassMode

BypassModeForRequest maps the presence of the client's x-amz-bypass-governance-retention header onto a BypassMode.

type CORSAllowanceConfig added in v1.0.17 

type CORSAllowanceConfig struct {
	Origin           string
	Methods          string
	ExposedHeaders   string
	AllowCredentials string
	AllowHeaders     string
	MaxAge           *int32
}

type CORSConfiguration added in v1.0.17 

type CORSConfiguration struct {
	Rules []CORSRule `xml:"CORSRule"`
}

func ParseCORSOutput added in v1.0.17 

func ParseCORSOutput(data []byte) (*CORSConfiguration, error)

ParseCORSOutput parses raw bytes to 'CORSConfiguration'

func (*CORSConfiguration) IsAllowed added in v1.0.17 

func (cc *CORSConfiguration) IsAllowed(origin string, method CORSHTTPMethod, headers []CORSHeader, rt s3err.ResourceType) (*CORSAllowanceConfig, error)

IsAllowed walks through the CORS rules and finds the first one allowing access. If no rule grants access, returns 'AccessForbidden'

func (*CORSConfiguration) Validate added in v1.0.17 

func (cc *CORSConfiguration) Validate() error

Validate validates the cors configuration rules

type CORSHTTPMethod added in v1.0.17 

type CORSHTTPMethod string

func (CORSHTTPMethod) IsEmpty added in v1.0.17 

func (cm CORSHTTPMethod) IsEmpty() bool

IsEmpty checks if the cors method is an empty string

func (CORSHTTPMethod) IsValid added in v1.0.17 

func (cm CORSHTTPMethod) IsValid() bool

IsValid validates the cors http request method: the methods are case sensitive

func (CORSHTTPMethod) String added in v1.0.17 

func (cm CORSHTTPMethod) String() string

String converts the method value to 'string'

type CORSHeader added in v1.0.17 

type CORSHeader string

func ParseCORSHeaders added in v1.0.17 

func ParseCORSHeaders(headers string) ([]CORSHeader, error)

ParseCORSHeaders parses/validates Access-Control-Request-Headers and returns []CORSHeaders

func (CORSHeader) IsValid added in v1.0.17 

func (ch CORSHeader) IsValid() bool

IsValid validates the CORS http header the rules are based on http RFC https://datatracker.ietf.org/doc/html/rfc7230#section-3.2

Empty values are considered as valid

func (CORSHeader) String added in v1.0.17 

func (ch CORSHeader) String() string

String converts the header value to 'string'

func (CORSHeader) ToLower added in v1.0.17 

func (ch CORSHeader) ToLower() string

ToLower converts the header to lower case

type CORSOrigin added in v1.3.0 

type CORSOrigin string

func (CORSOrigin) String added in v1.3.0 

func (co CORSOrigin) String() string

String converts the origin value to 'string'

func (CORSOrigin) Validate added in v1.3.0 

func (co CORSOrigin) Validate() error

Validate validates the cors allowed origin

type CORSRule added in v1.0.17 

type CORSRule struct {
	AllowedMethods []CORSHTTPMethod `xml:"AllowedMethod"`
	AllowedHeaders []CORSHeader     `xml:"AllowedHeader"`
	ExposeHeaders  []CORSHeader     `xml:"ExposeHeader"`
	AllowedOrigins []CORSOrigin     `xml:"AllowedOrigin"`
	ID             *string
	MaxAgeSeconds  *int32
}

func (*CORSRule) GetAllowedMethods added in v1.0.17 

func (cr *CORSRule) GetAllowedMethods() string

GetAllowedMethods returns comma separated CORS allowed methods

func (*CORSRule) GetExposeHeaders added in v1.0.17 

func (cr *CORSRule) GetExposeHeaders() string

GetExposeHeaders returns comma separated CORS expose headers

func (*CORSRule) Match added in v1.0.17 

func (cr *CORSRule) Match(origin string, method CORSHTTPMethod, headers []CORSHeader) (bool, bool)

Match matches the provided origin, method and headers with the CORS configuration rule if the matching origin is "*", it returns true as the first argument

func (*CORSRule) Validate added in v1.0.17 

func (cr *CORSRule) Validate() error

Validate validates and returns error if CORS configuration has invalid rule

type CertReloader added in v1.9.0 

type CertReloader interface {
	ReloadCerts() error
}

CertReloader is implemented by IAM backends that load TLS material from files for their own outbound connections, so a SIGHUP can pick up rotated certificates and CA bundles without a restart. On error the backend keeps using what it had.

type FixedBucketOwner added in v1.8.0 

type FixedBucketOwner interface {
	BucketOwner() Account
}

FixedBucketOwner is implemented by IAM backends that give every bucket the same owner instead of the account that created it — currently only the standalone IAM service client, which has no per-user ownership to express: every account is a plain RoleUser, they cannot be enumerated, and access is decided by IAM policy rather than by ACL.

Backends that do not implement it keep per-creator ownership as before.

type GetBucketAclOutput 

type GetBucketAclOutput struct {
	XMLName           xml.Name `xml:"http://s3.amazonaws.com/doc/2006-03-01/ AccessControlPolicy"`
	Owner             *types.Owner
	AccessControlList AccessControlList
}

func ParseACLOutput 

func ParseACLOutput(data []byte, owner string) (GetBucketAclOutput, error)

type Grant added in v1.0.4 

type Grant struct {
	Grantee    *Grt       `xml:"Grantee"`
	Permission Permission `xml:"Permission"`
}

type Grantee 

type Grantee struct {
	Permission Permission
	Access     string
	Type       types.Type
}

type Grt added in v1.0.4 

type Grt struct {
	XMLNS string     `xml:"xmlns:xsi,attr"`
	Type  types.Type `xml:"xsi:type,attr"`
	ID    string     `xml:"ID"`
}

func (*Grt) UnmarshalXML added in v1.0.10 

func (g *Grt) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error

Custom Unmarshalling for Grt to parse xsi:type properly

type IAMCache 

type IAMCache struct {
	// contains filtered or unexported fields
}

IAMCache is an in memory cache of the IAM accounts with expiration. This helps to alleviate the load on the real IAM service if the gateway is handling many requests. This forwards account updates to the underlying service, and returns cached results while the in memory account is not expired.

func NewCache 

func NewCache(service IAMService, expireTime, cleanupInterval time.Duration) *IAMCache

NewCache initializes an IAM cache for the provided service. The expireTime is the duration a cache entry can be valid, and the cleanupInterval is how often to scan cache and cleanup expired entries.

func (*IAMCache) CreateAccount 

func (c *IAMCache) CreateAccount(account Account) error

CreateAccount send create to IAM service and creates an account cache entry

func (*IAMCache) DeleteUserAccount 

func (c *IAMCache) DeleteUserAccount(access string) error

DeleteUserAccount deletes account from IAM service and cache

func (*IAMCache) GetUserAccount 

func (c *IAMCache) GetUserAccount(access string) (Account, error)

GetUserAccount retrieves the cache account if it is in the cache and not expired. Otherwise retrieves from underlying IAM service and caches result for the expire duration.

func (*IAMCache) GetUserAccountFresh added in v1.8.0 

func (c *IAMCache) GetUserAccountFresh(access string) (Account, error)

GetUserAccountFresh bypasses the in-memory cache and fetches the account directly from the underlying IAM service, then refreshes the cached entry with the result. This gives callers that need revocation to take effect immediately (rather than after the cache TTL) a way to observe the backing store state.

func (*IAMCache) ListUserAccounts 

func (c *IAMCache) ListUserAccounts() ([]Account, error)

ListUserAccounts is a passthrough to the underlying service and does not make use of the cache

func (*IAMCache) ResolveAccounts added in v1.8.0 

func (c *IAMCache) ResolveAccounts(accessKeyIDs []string) ([]string, error)

ResolveAccounts returns the subset of accessKeyIDs that do not exist. It loops over the cache's own GetUserAccount so lookups benefit from caching the same way a single-account check would.

func (*IAMCache) Shutdown 

func (c *IAMCache) Shutdown() error

Shutdown graceful termination of service

func (*IAMCache) UpdateUserAccount added in v1.0.2 

func (c *IAMCache) UpdateUserAccount(access string, props MutableProps) error

type IAMService 

type IAMService interface {
	CreateAccount(account Account) error
	GetUserAccount(access string) (Account, error)
	ResolveAccounts(accessKeyIDs []string) ([]string, error)
	UpdateUserAccount(access string, props MutableProps) error
	DeleteUserAccount(access string) error
	ListUserAccounts() ([]Account, error)
	Shutdown() error
}

IAMService is the interface for all IAM service implementations

func New 

func New(o *Opts) (IAMService, error)

func NewIAMServiceSingle added in v1.0.13 

func NewIAMServiceSingle(r Account) IAMService

func NewLDAPService 

func NewLDAPService(rootAcc Account, ldapURL, bindDN, pass, queryBase, accAtr, secAtr, roleAtr, userIdAtr, groupIdAtr, projectIdAtr, objClasses string, tlsSkipVerify bool) (IAMService, error)

func NewVaultIAMService 

func NewVaultIAMService(rootAcc Account, endpoint, namespace, secretStoragePath, secretStorageNamespace,
	authMethod, authNamespace, mountPath, rootToken, roleID, roleSecret, serverCert,
	clientCert, clientCertKey string) (IAMService, error)

type IAMServiceInternal 

type IAMServiceInternal struct {
	// This mutex will help with racing updates to the IAM data
	// from multiple requests to this gateway instance, but
	// will not help with racing updates to multiple load balanced
	// gateway instances. This is a limitation of the internal
	// IAM service. All account updates should be sent to a single
	// gateway instance if possible.
	sync.RWMutex
	// contains filtered or unexported fields
}

IAMServiceInternal manages the internal IAM service

func NewInternal 

func NewInternal(rootAcc Account, dir string) (*IAMServiceInternal, error)

NewInternal creates a new instance for the Internal IAM service

func (*IAMServiceInternal) CreateAccount 

func (s *IAMServiceInternal) CreateAccount(account Account) error

CreateAccount creates a new IAM account. Returns an error if the account already exists.

func (*IAMServiceInternal) DeleteUserAccount 

func (s *IAMServiceInternal) DeleteUserAccount(access string) error

DeleteUserAccount deletes the specified user account. Does not check if account exists.

func (*IAMServiceInternal) GetUserAccount 

func (s *IAMServiceInternal) GetUserAccount(access string) (Account, error)

GetUserAccount retrieves account info for the requested user. Returns ErrNoSuchUser if the account does not exist.

func (*IAMServiceInternal) ListUserAccounts 

func (s *IAMServiceInternal) ListUserAccounts() ([]Account, error)

ListUserAccounts lists all the user accounts stored.

func (*IAMServiceInternal) ResolveAccounts added in v1.8.0 

func (s *IAMServiceInternal) ResolveAccounts(accessKeyIDs []string) ([]string, error)

ResolveAccounts returns the subset of accessKeyIDs that do not exist.

func (*IAMServiceInternal) Shutdown 

func (s *IAMServiceInternal) Shutdown() error

Shutdown graceful termination of service

func (*IAMServiceInternal) UpdateUserAccount added in v1.0.2 

func (s *IAMServiceInternal) UpdateUserAccount(access string, props MutableProps) error

UpdateUserAccount updates the specified user account fields. Returns ErrNoSuchUser if the account does not exist.

type IAMServiceS3 

type IAMServiceS3 struct {
	// This mutex will help with racing updates to the IAM data
	// from multiple requests to this gateway instance, but
	// will not help with racing updates to multiple load balanced
	// gateway instances. This is a limitation of the internal
	// IAM service. All account updates should be sent to a single
	// gateway instance if possible.
	sync.RWMutex
	// contains filtered or unexported fields
}

func NewS3 

func NewS3(rootAcc Account, access, secret, region, bucket, endpoint string, sslSkipVerify bool) (*IAMServiceS3, error)

func (*IAMServiceS3) CreateAccount 

func (s *IAMServiceS3) CreateAccount(account Account) error

func (*IAMServiceS3) DeleteUserAccount 

func (s *IAMServiceS3) DeleteUserAccount(access string) error

func (*IAMServiceS3) GetUserAccount 

func (s *IAMServiceS3) GetUserAccount(access string) (Account, error)

func (*IAMServiceS3) ListUserAccounts 

func (s *IAMServiceS3) ListUserAccounts() ([]Account, error)

func (*IAMServiceS3) ResolveAccounts added in v1.8.0 

func (s *IAMServiceS3) ResolveAccounts(accessKeyIDs []string) ([]string, error)

ResolveAccounts returns the subset of accessKeyIDs that do not exist.

func (*IAMServiceS3) Shutdown 

func (s *IAMServiceS3) Shutdown() error

func (*IAMServiceS3) UpdateUserAccount added in v1.0.2 

func (s *IAMServiceS3) UpdateUserAccount(access string, props MutableProps) error

type IAMServiceSingle 

type IAMServiceSingle struct {
	// contains filtered or unexported fields
}

IAMServiceSingle manages the single tenant (root-only) IAM service

func (IAMServiceSingle) CreateAccount 

func (IAMServiceSingle) CreateAccount(account Account) error

CreateAccount not valid in single tenant mode

func (IAMServiceSingle) DeleteUserAccount 

func (IAMServiceSingle) DeleteUserAccount(access string) error

DeleteUserAccount no accounts in single tenant mode

func (IAMServiceSingle) GetUserAccount 

func (s IAMServiceSingle) GetUserAccount(access string) (Account, error)

GetUserAccount returns root account, if the root access key is provided and ErrNoSuchUser otherwise

func (IAMServiceSingle) ListUserAccounts 

func (IAMServiceSingle) ListUserAccounts() ([]Account, error)

ListUserAccounts no accounts in single tenant mode

func (IAMServiceSingle) ResolveAccounts added in v1.8.0 

func (s IAMServiceSingle) ResolveAccounts(accessKeyIDs []string) ([]string, error)

ResolveAccounts returns the subset of accessKeyIDs that do not exist.

func (IAMServiceSingle) Shutdown 

func (IAMServiceSingle) Shutdown() error

Shutdown graceful termination of service

func (IAMServiceSingle) UpdateUserAccount added in v1.0.2 

func (IAMServiceSingle) UpdateUserAccount(access string, props MutableProps) error

UpdateUserAccount no accounts in single tenant mode

type IAMServiceStandalone added in v1.8.0 

type IAMServiceStandalone struct {
	// contains filtered or unexported fields
}

IAMServiceStandalone is the S3 gateway's client for a standalone IAM service's private endpoints. It never holds a plaintext secret for any account but its own signing identity and the locally-known root account — every other account's secret stays inside the IAM service process. CreateAccount/UpdateUserAccount/ DeleteUserAccount/ListUserAccounts are unsupported here for the same reason: mutating a user requires setting a secret, which must never flow into this process — manage users via the IAM service's own control-plane API instead.

func NewIAMServiceStandalone added in v1.8.0 

func NewIAMServiceStandalone(rootAcc Account, cfg IAMServiceStandaloneConfig) (*IAMServiceStandalone, error)

NewIAMServiceStandalone constructs the standalone IAM service client. rootAcc is the gateway's own root account — always resolved locally, never round-tripped through the IAM service.

func (*IAMServiceStandalone) BucketOwner added in v1.8.0 

func (s *IAMServiceStandalone) BucketOwner() Account

BucketOwner implements FixedBucketOwner: every bucket is owned by the gateway's root account, the only account this process knows locally.

func (*IAMServiceStandalone) CreateAccount added in v1.8.0 

func (s *IAMServiceStandalone) CreateAccount(Account) error

CreateAccount is not supported

func (*IAMServiceStandalone) DeleteUserAccount added in v1.8.0 

func (s *IAMServiceStandalone) DeleteUserAccount(string) error

DeleteUserAccount is not supported

func (*IAMServiceStandalone) DeriveSigningKey added in v1.8.0 

func (s *IAMServiceStandalone) DeriveSigningKey(access, sessionToken, date, region, service string) ([]byte, Account, error)

DeriveSigningKey implements SigningKeyProvider. Root is special-cased locally: its secret is already known to this process either way, so there's no reason to round-trip it through the IAM service.

func (*IAMServiceStandalone) EvaluatePolicy added in v1.8.0 

func (s *IAMServiceStandalone) EvaluatePolicy(access, sessionToken string, actions []Action, resources []string, condition map[string][]string) (PolicyEvaluation, error)

EvaluatePolicy implements PolicyEvaluator, evaluating every action in actions against resource in a single request rather than one round trip per action.

func (*IAMServiceStandalone) GetUserAccount added in v1.8.0 

func (s *IAMServiceStandalone) GetUserAccount(access string) (Account, error)

GetUserAccount resolves access via the resolve-identity endpoint, which answers existence and principal identity while returning no credential material at all. This is not blanket-unsupported like the mutating methods below: ResolveAccounts (bucket-policy Principal and ACL grantee validation) depends on GetUserAccount working to tell a nonexistent grantee (ErrNoSuchUser) apart from an unsupported one (ErrAdminMethodNotSupported, which it treats as fatal).

Callers that need to validate several access keys at once should use ResolveAccounts instead — one round trip for the whole set rather than one per key.

func (*IAMServiceStandalone) ListUserAccounts added in v1.8.0 

func (s *IAMServiceStandalone) ListUserAccounts() ([]Account, error)

ListUserAccounts is not supported

func (*IAMServiceStandalone) ReloadCerts added in v1.9.0 

func (s *IAMServiceStandalone) ReloadCerts() error

ReloadCerts implements CertReloader: it re-reads the client cert/key and the server CA bundle into a new client, so requests from here on connect with the rotated files. Requests already in flight finish on the old client, whose connections close once idle instead of being reused. A unix socket endpoint has no TLS material, so there is nothing to reload.

func (*IAMServiceStandalone) ResolveAccounts added in v1.8.0 

func (s *IAMServiceStandalone) ResolveAccounts(accessKeyIDs []string) ([]string, error)

ResolveAccounts returns the subset of accessKeyIDs that do not exist, in a single round trip. A temporary (ASIA…) session access key counts as nonexistent even while its session is live — see resolvedAccount.IsSession.

func (*IAMServiceStandalone) ResolvePrincipals added in v1.8.0 

func (s *IAMServiceStandalone) ResolvePrincipals(principals []string) ([]string, error)

ResolvePrincipals implements PrincipalResolver, validating a bucket policy's principals in a single round trip regardless of how many it names.

func (*IAMServiceStandalone) Shutdown added in v1.8.0 

func (s *IAMServiceStandalone) Shutdown() error

func (*IAMServiceStandalone) UpdateUserAccount added in v1.8.0 

func (s *IAMServiceStandalone) UpdateUserAccount(string, MutableProps) error

UpdateUserAccount is not supported

type IAMServiceStandaloneConfig added in v1.8.0 

type IAMServiceStandaloneConfig struct {
	// Endpoint is either a "host:port" TCP address (mTLS required -
	// ClientCert/ClientCertKey/ServerCA) or a unix socket path, matching
	// the standalone IAM service's own --private-ports address shape.
	Endpoint string
	// Access/Secret are this client's own SigV4 identity — the credential
	// it signs its private requests with. Both must be set together, or
	// both left empty to sign with the gateway's root account.
	Access string
	Secret string
	// ClientCert/ClientCertKey/ServerCA configure outbound mTLS. Required
	// (all three) for a TCP Endpoint; unused for a unix socket Endpoint.
	ClientCert    string
	ClientCertKey string
	ServerCA      string
	// DefaultUserID/GroupID/ProjectID are assigned to every account this
	// client resolves, the locally-held root account included: bucket
	// ownership is fixed to root here, so root must carry the same POSIX
	// identity as everyone else or a backend chowning to it would target
	// uid/gid 0. The standalone IAM service's user model
	// (iamapi/types.User, mirroring real AWS IAM) has no POSIX uid/gid/
	// project-id concept, so there is no per-user value to fetch instead —
	// every standalone-backed account shares one POSIX identity for
	// backend file-ownership purposes.
	DefaultUserID    int
	DefaultGroupID   int
	DefaultProjectID int
	// Region is the gateway's own configured region, reported to the IAM
	// service as the region an S3 request was made in when it records the
	// caller's last-used metadata. It is taken from configuration rather
	// than from the request's credential scope on purpose: the scope is
	// attacker-controlled until the signature is verified. Empty disables
	// the reporting rather than storing a blank region.
	Region string
}

IAMServiceStandaloneConfig configures IAMServiceStandalone.

type IpaIAMService added in v1.0.10 

type IpaIAMService struct {
	// contains filtered or unexported fields
}

func NewIpaIAMService added in v1.0.10 

func NewIpaIAMService(rootAcc Account, host, vaultName, username, password string, isInsecure bool) (*IpaIAMService, error)

func (*IpaIAMService) CreateAccount added in v1.0.10 

func (ipa *IpaIAMService) CreateAccount(account Account) error

func (*IpaIAMService) DeleteUserAccount added in v1.0.10 

func (ipa *IpaIAMService) DeleteUserAccount(access string) error

func (*IpaIAMService) GetUserAccount added in v1.0.10 

func (ipa *IpaIAMService) GetUserAccount(access string) (Account, error)

func (*IpaIAMService) ListUserAccounts added in v1.0.10 

func (ipa *IpaIAMService) ListUserAccounts() ([]Account, error)

func (*IpaIAMService) ResolveAccounts added in v1.8.0 

func (ipa *IpaIAMService) ResolveAccounts(accessKeyIDs []string) ([]string, error)

ResolveAccounts returns the subset of accessKeyIDs that do not exist.

func (*IpaIAMService) Shutdown added in v1.0.10 

func (ipa *IpaIAMService) Shutdown() error

func (*IpaIAMService) UpdateUserAccount added in v1.0.10 

func (ipa *IpaIAMService) UpdateUserAccount(access string, props MutableProps) error

type LdapIAMService 

type LdapIAMService struct {
	// contains filtered or unexported fields
}

func (*LdapIAMService) CreateAccount 

func (ld *LdapIAMService) CreateAccount(account Account) error

func (*LdapIAMService) DeleteUserAccount 

func (ld *LdapIAMService) DeleteUserAccount(access string) error

func (*LdapIAMService) GetUserAccount 

func (ld *LdapIAMService) GetUserAccount(access string) (Account, error)

func (*LdapIAMService) ListUserAccounts 

func (ld *LdapIAMService) ListUserAccounts() ([]Account, error)

func (*LdapIAMService) ResolveAccounts added in v1.8.0 

func (ld *LdapIAMService) ResolveAccounts(accessKeyIDs []string) ([]string, error)

ResolveAccounts returns the subset of accessKeyIDs that do not exist.

func (*LdapIAMService) Shutdown 

func (ld *LdapIAMService) Shutdown() error

Shutdown graceful termination of service

func (*LdapIAMService) UpdateUserAccount added in v1.0.2 

func (ld *LdapIAMService) UpdateUserAccount(access string, props MutableProps) error

type ListUserAccountsResult added in v1.0.8 

type ListUserAccountsResult struct {
	Accounts []Account
}

type MutableProps added in v1.0.2 

type MutableProps struct {
	Secret    *string `json:"secret"`
	Role      Role    `json:"role"`
	UserID    *int    `json:"userID"`
	GroupID   *int    `json:"groupID"`
	ProjectID *int    `json:"projectID"`
}

Mutable props, which could be changed when updating an IAM account

func (MutableProps) Validate added in v1.0.14 

func (m MutableProps) Validate() error

type Opts 

type Opts struct {
	RootAccount                 Account
	Dir                         string
	LDAPServerURL               string
	LDAPBindDN                  string
	LDAPPassword                string
	LDAPQueryBase               string
	LDAPObjClasses              string
	LDAPAccessAtr               string
	LDAPSecretAtr               string
	LDAPRoleAtr                 string
	LDAPUserIdAtr               string
	LDAPGroupIdAtr              string
	LDAPProjectIdAtr            string
	LDAPTLSSkipVerify           bool
	VaultEndpointURL            string
	VaultNamespace              string
	VaultSecretStoragePath      string
	VaultSecretStorageNamespace string
	VaultAuthMethod             string
	VaultAuthNamespace          string
	VaultMountPath              string
	VaultRootToken              string
	VaultRoleId                 string
	VaultRoleSecret             string
	VaultServerCert             string
	VaultClientCert             string
	VaultClientCertKey          string
	S3Access                    string
	S3Secret                    string
	S3Region                    string
	S3Bucket                    string
	S3Endpoint                  string
	S3DisableSSlVerfiy          bool
	CacheDisable                bool
	CacheTTL                    int
	CachePrune                  int
	IpaHost                     string
	IpaVaultName                string
	IpaUser                     string
	IpaPassword                 string
	IpaInsecure                 bool
	StandaloneIAMEndpoint       string
	StandaloneIAMAccess         string
	StandaloneIAMSecret         string
	StandaloneClientCert        string
	StandaloneClientCertKey     string
	StandaloneServerCA          string
	StandaloneDefaultUserID     int
	StandaloneDefaultGroupID    int
	StandaloneDefaultProjectID  int
	StandaloneRegion            string
}

type POSTPolicy added in v1.4.0 

type POSTPolicy struct {
	// contains filtered or unexported fields
}

POSTPolicy is the parsed browser-based upload policy document.

func ParsePOSTPolicyBase64 added in v1.4.0 

func ParsePOSTPolicyBase64(encoded string) (*POSTPolicy, error)

ParsePOSTPolicyBase64 decodes and validates a base64-encoded POST policy.

func (*POSTPolicy) Evaluate added in v1.4.0 

func (p *POSTPolicy) Evaluate(in PostPolicyEvalInput) error

Evaluate returns nil if the input satisfies the policy. Otherwise it returns a deny reason.

type Permission added in v1.0.10 

type Permission string
const (
	PermissionFullControl Permission = "FULL_CONTROL"
	PermissionWrite       Permission = "WRITE"
	PermissionWriteAcp    Permission = "WRITE_ACP"
	PermissionRead        Permission = "READ"
	PermissionReadAcp     Permission = "READ_ACP"
)

type PolicyEvaluation added in v1.8.0 

type PolicyEvaluation struct {
	Decisions        [][]policyDecision
	SessionDecisions [][]policyDecision
	HasSessionPolicy bool
	PrincipalArn     string
}

PolicyEvaluation is what a PolicyEvaluator reports for a batch of resources and actions evaluated together in a single request.

Decisions[i][j] is the tri-state decision for resources[i] and actions[j], in the order both were given to EvaluatePolicy. PrincipalArn is the (best-effort) resolved principal ARN, shared across the whole batch since one call always evaluates a single identity — it is used only to build an AWS-shaped Deny message, and is "" when it can't be resolved, in which case the caller falls back to the access key.

SessionDecisions is the same matrix evaluated against the caller's session policy alone, meaningful only when HasSessionPolicy is set. A session policy filters everything the session can do, including what the bucket policy grants it, so it cannot be folded into Decisions — which describe only the identity (user or role) policies.

type PolicyEvaluator added in v1.8.0 

type PolicyEvaluator interface {
	EvaluatePolicy(access, sessionToken string, actions []Action, resources []string, condition map[string][]string) (PolicyEvaluation, error)
}

PolicyEvaluator is implemented by IAM backends that enforce IAM identity (user/role/session) policies against S3 requests — currently only the standalone IAM service client. VerifyAccess type-asserts for this interface and, when present, combines its tri-state decision for each action with the bucket's own policy/ACL decision for that action using AWS's real precedence: an explicit Deny from either source wins outright, otherwise either source's Allow is independently sufficient; backends without it are unaffected — there is no identity-policy layer for them.

The full actions × resources matrix is evaluated in a single batched request rather than one round trip per cell. Both dimensions are really used: a copy checks several actions (its source's and destination's), and a batch delete checks several resources (one object ARN per key, up to 1000 of them). A round trip per cell would multiply request latency for no benefit, since one request can carry the whole matrix.

condition carries only the condition keys the gateway itself can observe from the request (aws:SourceIp, aws:CurrentTime, aws:SecureTransport, …); the identity-derived keys are filled in by the implementation, which is the only side that knows who the access key belongs to.

type PolicyVersion added in v1.0.19 

type PolicyVersion string
const (
	PolicyVersion2008 PolicyVersion = "2008-10-17"
	PolicyVersion2012 PolicyVersion = "2012-10-17"
)

type PostPolicyEvalInput added in v1.4.0 

type PostPolicyEvalInput struct {
	Bucket        string
	Key           string
	ContentLength int64
	Fields        map[string]string
}

PostPolicyEvalInput is all the data required to evaluate the policy. Fields should contain already-expanded form values.

type PrincipalResolver added in v1.8.0 

type PrincipalResolver interface {
	// ResolvePrincipals returns the subset of principals that do not name
	// anything — the write-time check behind PutBucketPolicy, mirroring
	// ResolveAccounts' "return what does not exist" contract for access
	// keys. The wildcard "*" is handled by the caller and never reaches
	// here.
	ResolvePrincipals(principals []string) ([]string, error)
}

PrincipalResolver is implemented by IAM backends whose identities are named by AWS-style principal ARNs — currently only the standalone IAM service client. Its presence is what switches a bucket policy's Principal element from naming access key ids to naming ARNs, the way real S3 does.

Every other backend (internal, LDAP, Vault, IPA, S3, single) has no ARNs to name anything by: its accounts are access keys and nothing else. Those backends do not implement this, and their bucket policies keep naming access key ids exactly as before.

type Principals 

type Principals map[string]struct{}

func (Principals) Add 

func (p Principals) Add(key string)

func (Principals) ToSlice 

func (p Principals) ToSlice() []string

Converts Principals map to a slice, by omitting "*"

func (*Principals) UnmarshalJSON 

func (p *Principals) UnmarshalJSON(data []byte) error

Override UnmarshalJSON method to decode both []string and string properties

func (Principals) Validate 

func (p Principals) Validate(iam IAMService) error

Validate checks that every principal named here exists, so a policy can never be stored naming somebody who cannot be matched. What a principal *is* depends on the IAM backend: an AWS-style ARN for a backend that implements PrincipalResolver, and an access key id for every other one.

The wildcard is checked the same way either way: "*" is only valid alone, never mixed with named principals.

type PutBucketAclInput added in v1.0.4 

type PutBucketAclInput struct {
	Bucket              *string
	ACL                 types.BucketCannedACL
	AccessControlPolicy *AccessControlPolicy
	GrantFullControl    *string
	GrantRead           *string
	GrantReadACP        *string
	GrantWrite          *string
	GrantWriteACP       *string
}

type Resources 

type Resources map[string]struct{}

func (Resources) Add 

func (r Resources) Add(rc string) error

Adds and validates a new resource to Resources map

func (Resources) ContainsBucketPattern 

func (r Resources) ContainsBucketPattern() bool

Checks if the resources contain bucket pattern

func (Resources) ContainsObjectPattern 

func (r Resources) ContainsObjectPattern() bool

Checks if the resources contain object pattern

func (Resources) FindMatch 

func (r Resources) FindMatch(resource string, normalizer objectKeyNormalizer) bool

func (Resources) Match added in v1.0.11 

func (r Resources) Match(pattern, input string, normalizer objectKeyNormalizer) bool

Match matches the given input resource with the pattern

func (*Resources) UnmarshalJSON 

func (r *Resources) UnmarshalJSON(data []byte) error

Override UnmarshalJSON method to decode both []string and string properties

func (Resources) Validate 

func (r Resources) Validate(bucket string) error

Bucket resources should start with bucket name: arn:aws:s3:::MyBucket/*

type Role 

type Role string
const (
	RoleUser     Role = "user"
	RoleAdmin    Role = "admin"
	RoleUserPlus Role = "userplus"
)

func (Role) IsValid added in v1.0.8 

func (r Role) IsValid() bool

type SigningKeyProvider added in v1.8.0 

type SigningKeyProvider interface {
	DeriveSigningKey(access, sessionToken, date, region, service string) ([]byte, Account, error)
}

SigningKeyProvider is implemented by IAM backends that can compute a SigV4 derived signing key (kSigning) without ever revealing the account's underlying secret to this process — currently only the standalone IAM service client (IAMServiceStandalone). Callers that resolve an IAMService's derived key type-assert for this interface first and fall back to fetching the account's secret via GetUserAccount and deriving the key locally (sigv4auth.DeriveKey) when it isn't implemented, so every other backend (internal, LDAP, Vault, IPA, S3) is unaffected.

date/region/service are the request's credential-scope components (yyyymmdd/region/service, matching sigv4auth.DeriveKey's parameters). sessionToken is the request's X-Amz-Security-Token, required when access is a temporary (ASIA…) key and empty otherwise.

The returned Account never has Secret populated. Returns ErrNoSuchUser if access does not exist (matching IAMService.GetUserAccount), or ErrInvalidSessionToken if the token is missing, wrong, or paired with a permanent access key.

type VaultIAMNamespace added in v1.0.19 

type VaultIAMNamespace struct {
	Auth          string
	SecretStorage string
}

type VaultIAMService 

type VaultIAMService struct {
	// contains filtered or unexported fields
}

func (*VaultIAMService) CreateAccount 

func (vt *VaultIAMService) CreateAccount(account Account) error

func (*VaultIAMService) DeleteUserAccount 

func (vt *VaultIAMService) DeleteUserAccount(access string) error

func (*VaultIAMService) GetUserAccount 

func (vt *VaultIAMService) GetUserAccount(access string) (Account, error)

func (*VaultIAMService) ListUserAccounts 

func (vt *VaultIAMService) ListUserAccounts() ([]Account, error)

func (*VaultIAMService) ResolveAccounts added in v1.8.0 

func (vt *VaultIAMService) ResolveAccounts(accessKeyIDs []string) ([]string, error)

ResolveAccounts returns the subset of accessKeyIDs that do not exist.

func (*VaultIAMService) Shutdown 

func (vt *VaultIAMService) Shutdown() error

the client doesn't have explicit shutdown, as it uses http.Client

func (*VaultIAMService) UpdateUserAccount added in v1.0.2 

func (vt *VaultIAMService) UpdateUserAccount(access string, props MutableProps) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.