CLDSRV-674: handle cross-account bucket policies by leif-scality · Pull Request #5855 · scality/cloudserver

leif-scality · 2025-07-02T09:08:15Z

Handle cross account cases when using bucket policies

https://scality.atlassian.net/browse/S3C-9896

bert-e · 2025-07-02T09:08:20Z

Hello leif-scality,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
`/after_pull_request`	Wait for the given pull request id to be merged before continuing with the current one.
`/bypass_author_approval`	Bypass the pull request author's approval	⭐
`/bypass_build_status`	Bypass the build and test status	⭐
`/bypass_commit_size`	Bypass the check on the size of the changeset `TBA`	⭐
`/bypass_incompatible_branch`	Bypass the check on the source branch prefix	⭐
`/bypass_jira_check`	Bypass the Jira issue check	⭐
`/bypass_peer_approval`	Bypass the pull request peers' approval	⭐
`/bypass_leader_approval`	Bypass the pull request leaders' approval	⭐
`/approve`	Instruct Bert-E that the author has approved the pull request.		✍️
`/create_pull_requests`	Allow the creation of integration pull requests.
`/create_integration_branches`	Allow the creation of integration branches.
`/no_octopus`	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
`/unanimity`	Change review acceptance criteria from `one reviewer at least` to `all reviewers`
`/wait`	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
`/help`	Print Bert-E's manual in the pull request.
`/status`	Print Bert-E's current status in the pull request `TBA`
`/clear`	Remove all comments from Bert-E from the history `TBA`
`/retry`	Re-start a fresh build `TBA`
`/build`	Re-start a fresh build `TBA`
`/force_reset`	Delete integration branches & pull requests, and restart merge process from the beginning.
`/reset`	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

bert-e · 2025-07-02T09:59:57Z

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.

ghost · 2025-07-02T11:38:07Z

+            for (const p of principal.CanonicalUser) {
+                if (out === checkPrincipalResult.OK) {
+                    break;
+                }
+
+                const res = _checkPrincipal(canonicalID, p, bucketOwnerCanonicalID, canonicalID);
+                if (res !== checkPrincipalResult.KO) {
+                    out = res;
+                }
+            }
+            return out;


to avoid nested if/for and duplication we should be able to use a helper function

something like:

function _findBestPrincipalMatch(principalArray, checkFunc) { let bestMatch = checkPrincipalResult.KO; if (!principalArray) { return bestMatch; } const principals = Array.isArray(principalArray) ? principalArray : [principalArray]; for (const p of principals) { const result = checkFunc(p); if (result === checkPrincipalResult.OK) { return checkPrincipalResult.OK; // Highest permission, can exit early } if (result > bestMatch) { bestMatch = result; } } return bestMatch; } function _checkPrincipals(canonicalID, arn, principal, bucketOwnerCanonicalID) { if (principal === '*') { // Handle anonymous or authenticated wildcard if (arn === undefined) { return checkPrincipalResult.OK; } return _getPermissionLevel(arn, bucketOwnerCanonicalID, canonicalID); // Assuming _getPermissionLevel is refactored } if (principal.CanonicalUser) { return _findBestPrincipalMatch(principal.CanonicalUser, p => _checkPrincipal(canonicalID, p, bucketOwnerCanonicalID, canonicalID)); } if (principal.AWS) { return _findBestPrincipalMatch(principal.AWS, p => _checkPrincipal(arn, p, bucketOwnerCanonicalID, canonicalID)); } return checkPrincipalResult.KO; }

leif-scality · 2025-07-09T09:31:31Z

@williamlardier I kept the diagram because the one in citadel is higher level than this one, I also think the diagram makes the function easier to understand.

ghost · 2025-07-11T06:58:20Z

+        return _checkCrossAccount(requesterARN, requesterCanonicalID, bucketOwnerCanonicalID);
+    }
+
+    if (principal.endsWith('root') && _getAccountId(principal) === _getAccountId(requesterARN)) {


Shouldn't it be /root to avoid valid user names ending in root?

Suggested change

if (principal.endsWith('root') && _getAccountId(principal) === _getAccountId(requesterARN)) {

if (principal.endsWith('/root') && _getAccountId(principal) === _getAccountId(requesterARN)) {

maybe a more formal check here would be better

I think we should do :root, /root is not a valid ARN, /account_name is only returned by vault when using the root access key's as explained in _IsRoot.
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-accounts

leif-scality · 2025-07-23T12:47:23Z

ping

BourgoisMickael · 2025-07-23T12:54:42Z

@bert-e create_pull_requests

bert-e · 2025-07-23T12:54:56Z

Integration data created

I have created the integration data for the additional destination branches.

this pull request will merge bugfix/CLDSRV-674 into
development/7.70
w/8.8/bugfix/CLDSRV-674 will be merged into development/8.8 (pull request W/8.8/bugfix/cldsrv 674 #5884)
w/9.0/bugfix/CLDSRV-674 will be merged into development/9.0 (pull request W/9.0/bugfix/cldsrv 674 #5885)
w/9.1/bugfix/CLDSRV-674 will be merged into development/9.1 (pull request INTEGRATION [PR#5855 > development/9.1] CLDSRV-674: handle cross-account bucket policies #5886)

The following branches will NOT be impacted:

development/7.10
development/7.4

Follow integration pull requests if you would like to be notified of
build statuses by email.

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2025-07-23T12:54:57Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_pull_requests, create_integration_branches

leif-scality · 2025-07-23T12:58:16Z

/approve

bert-e · 2025-07-23T13:02:46Z

Build failed

The build for commit did not succeed in branch w/8.8/bugfix/CLDSRV-674

The following options are set: approve, create_pull_requests, create_integration_branches

bert-e · 2025-07-23T13:06:41Z

Build failed

The build for commit did not succeed in branch w/9.0/bugfix/CLDSRV-674

The following options are set: approve, create_pull_requests, create_integration_branches

bert-e · 2025-07-23T13:22:35Z

Build failed

The build for commit did not succeed in branch w/9.1/bugfix/CLDSRV-674

The following options are set: approve, create_pull_requests, create_integration_branches

bert-e · 2025-07-23T13:25:13Z

Build failed

The build for commit did not succeed in branch w/9.0/bugfix/CLDSRV-674

The following options are set: approve, create_pull_requests, create_integration_branches

bert-e · 2025-07-23T13:41:26Z

Build failed

The build for commit did not succeed in branch w/9.1/bugfix/CLDSRV-674

The following options are set: approve, create_pull_requests, create_integration_branches

bert-e · 2025-07-23T14:11:14Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ development/7.70
✔️ development/8.8
✔️ development/9.0
✔️ development/9.1

The following branches have NOT changed:

development/7.10
development/7.4

Please check the status of the associated issue CLDSRV-674.

Goodbye leif-scality.

The following options are set: approve, create_pull_requests, create_integration_branches

This comment was marked as outdated.

Sign in to view

leif-scality force-pushed the bugfix/CLDSRV-674 branch 2 times, most recently from ccf75c1 to b4639ec Compare July 2, 2025 09:47

leif-scality requested a review from Copilot July 2, 2025 09:51

This comment was marked as outdated.

Sign in to view

leif-scality force-pushed the bugfix/CLDSRV-674 branch from b4639ec to 15d4bab Compare July 2, 2025 09:58

leif-scality requested a review from Copilot July 2, 2025 09:58

leif-scality changed the base branch from development/9.0 to development/7.70 July 2, 2025 09:59

This comment was marked as outdated.

Sign in to view

leif-scality force-pushed the bugfix/CLDSRV-674 branch from 15d4bab to 1d88478 Compare July 2, 2025 10:04

leif-scality requested a review from Copilot July 2, 2025 10:05

This comment was marked as outdated.

Sign in to view

ghost reviewed Jul 2, 2025

View reviewed changes

BourgoisMickael reviewed Jul 4, 2025

View reviewed changes

Comment thread lib/api/apiUtils/authorization/permissionChecks.js

leif-scality force-pushed the bugfix/CLDSRV-674 branch from 1d88478 to d4a82f0 Compare July 4, 2025 16:30

leif-scality requested a review from Copilot July 4, 2025 16:50

This comment was marked as resolved.

Sign in to view

leif-scality requested review from a user and BourgoisMickael July 7, 2025 10:07

ghost reviewed Jul 9, 2025

View reviewed changes

leif-scality requested a review from a user July 9, 2025 09:31

BourgoisMickael reviewed Jul 10, 2025

View reviewed changes

Comment thread lib/api/apiUtils/authorization/permissionChecks.js Outdated

ghost reviewed Jul 11, 2025

View reviewed changes

leif-scality force-pushed the bugfix/CLDSRV-674 branch from f97e991 to 969e154 Compare July 15, 2025 13:44

leif-scality requested review from a user and BourgoisMickael July 17, 2025 15:43

ghost approved these changes Jul 18, 2025

View reviewed changes

Comment thread Dockerfile Outdated

CLDSRV-674: fix lint issue

74a93e6

scality deleted a comment from leif-scality Jul 23, 2025

scality deleted a comment from bert-e Jul 23, 2025

scality deleted a comment from leif-scality Jul 23, 2025

scality deleted a comment from bert-e Jul 23, 2025

bert-e mentioned this pull request Jul 23, 2025

INTEGRATION [PR#5855 > development/9.1] CLDSRV-674: handle cross-account bucket policies #5886

Merged

scality deleted a comment from bert-e Jul 23, 2025

scality deleted a comment from leif-scality Jul 23, 2025

scality deleted a comment from bert-e Jul 23, 2025

scality deleted a comment from leif-scality Jul 23, 2025

bert-e merged commit 74a93e6 into development/7.70 Jul 23, 2025
18 checks passed

bert-e deleted the bugfix/CLDSRV-674 branch July 23, 2025 14:11

	if (principal.endsWith('root') && _getAccountId(principal) === _getAccountId(requesterARN)) {
	if (principal.endsWith('/root') && _getAccountId(principal) === _getAccountId(requesterARN)) {

Conversation

leif-scality commented Jul 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bert-e commented Jul 2, 2025

Hello leif-scality,

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

Uh oh!

bert-e commented Jul 2, 2025

Request integration branches

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

ghost Jul 2, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

leif-scality commented Jul 9, 2025

Uh oh!

Uh oh!

Uh oh!

ghost Jul 11, 2025 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

leif-scality Jul 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

leif-scality commented Jul 23, 2025

Uh oh!

BourgoisMickael commented Jul 23, 2025

Uh oh!

bert-e commented Jul 23, 2025

Integration data created

Uh oh!

bert-e commented Jul 23, 2025

Waiting for approval

Uh oh!

leif-scality commented Jul 23, 2025

Uh oh!

bert-e commented Jul 23, 2025

Build failed

Uh oh!

bert-e commented Jul 23, 2025

Build failed

Uh oh!

bert-e commented Jul 23, 2025

Build failed

Uh oh!

bert-e commented Jul 23, 2025

Build failed

Uh oh!

bert-e commented Jul 23, 2025

Build failed

Uh oh!

bert-e commented Jul 23, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

leif-scality commented Jul 2, 2025 •

edited

Loading

ghost Jul 11, 2025 •

edited by ghost

Loading

leif-scality Jul 11, 2025 •

edited

Loading