Skip to content

Added support for iam user in list_buckets() for containerized #9316

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 27, 2025
Merged

Added support for iam user in list_buckets() for containerized #9316

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 13 additions & 4 deletions src/server/common_services/auth_server.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -556,6 +556,17 @@ function is_bucket_claim_owner(bucket, account) {
return account.bucket_claim_owner.name.unwrap() === bucket.name.unwrap();
}

/**
* is_iam_and_same_root_account_owner checks if the account is the IAM user and the same root account owner of the bucket
* @param {Record<string, any>} account
* @param {Record<string, any>} bucket
* @returns {boolean}
*/
function is_iam_and_same_root_account_owner(account, bucket) {
if (!account?.owner || !bucket?.owner_account) return false;
return account.owner._id.toString() === bucket.owner_account._id.toString();
}

/**
* has_bucket_ownership_permission returns true if the account can list the bucket in ListBuckets operation
*
Expand Down Expand Up @@ -585,7 +596,7 @@ async function has_bucket_ownership_permission(bucket, account, role) {
if (is_bucket_claim_owner(bucket, account)) return true;

// special case: iam user can list the buckets of their owner
// TODO: handle iam user
if (is_iam_and_same_root_account_owner(account, bucket)) return true;

return false;
}
Expand Down Expand Up @@ -620,9 +631,7 @@ async function has_bucket_action_permission(bucket, account, action, req_query,
if (!bucket_policy) {
// in case we do not have bucket policy
// we allow IAM account to access a bucket that is owned by their root account
const is_iam_and_same_root_account_owner = account.owner !== undefined &&
account.owner._id.toString() === bucket.owner_account._id.toString();
return has_owner_access || is_iam_and_same_root_account_owner;
return has_owner_access || is_iam_and_same_root_account_owner(account, bucket);
}
if (!action) {
throw new Error('has_bucket_action_permission: action is required');
Expand Down