Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(oss): enable bucket access for ram role #194

Merged
merged 2 commits into from
Dec 24, 2024
Merged

feat(oss): enable bucket access for ram role #194

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0ffbd98
feat(oss): enable bucket access for ram role
Dec 20, 2024
d8d1548
refactor: code reviews
Dec 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 35 additions & 11 deletions plugins/providers/oss/provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,7 +258,7 @@ func revokePermissionsFromPolicy(policyString string, g domain.Grant) (string, e
return "", err
}

principalAccountID, err := getPrincipalFromAccountID(g.AccountID)
principalAccountID, err := getPrincipalFromAccountID(g.AccountID, g.AccountType)
if err != nil {
return "", err
}
Expand Down Expand Up @@ -310,7 +310,7 @@ func updatePolicyToGrantPermissions(policy string, g domain.Grant) (string, erro
return "", err
}

principalAccountID, err := getPrincipalFromAccountID(g.AccountID)
principalAccountID, err := getPrincipalFromAccountID(g.AccountID, g.AccountType)
if err != nil {
return "", err
}
Expand Down Expand Up @@ -462,18 +462,42 @@ func getAccountIDFromResource(resource *domain.Resource) (string, error) {
return urnParts[2], nil
}

func getPrincipalFromAccountID(accountID string) (string, error) {
accountIDParts := strings.Split(accountID, "$")
if len(accountIDParts) < 2 {
return "", fmt.Errorf("invalid accountID format")
}
func getPrincipalFromAccountID(accountID, accountType string) (string, error) {
// AccountTypeRAMUser = RAM$<uid>:<sub-account-id>
// AccountTypeRAMRole = acs:ram::<uid>:role/<role-name>
if accountType == AccountTypeRAMUser {
accountIDParts := strings.Split(accountID, "$")
if len(accountIDParts) < 2 {
return "", fmt.Errorf("invalid accountID format")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return "", fmt.Errorf("invalid accountID format")
return "", fmt.Errorf("invalid accountID format: %q", accountID)

}

subParts := strings.Split(accountIDParts[1], ":")
if len(subParts) < 2 {
return "", fmt.Errorf("invalid accountID format")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return "", fmt.Errorf("invalid accountID format")
return "", fmt.Errorf("invalid accountID format: %q", accountID)

}

return subParts[1], nil
} else if accountType == AccountTypeRAMRole {

subParts := strings.Split(accountIDParts[1], ":")
if len(subParts) < 2 {
return "", fmt.Errorf("invalid accountID format")
accountIDParts := strings.Split(accountID, ":")
if len(accountIDParts) < 5 {
return "", fmt.Errorf("invalid accountID format")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return "", fmt.Errorf("invalid accountID format")
return "", fmt.Errorf("invalid accountID format: %q", accountID)

}

mainAccountID := accountIDParts[3]
roleNameParts := strings.Split(accountIDParts[4], "/")
if len(roleNameParts) < 2 {
return "", fmt.Errorf("invalid accountID format")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return "", fmt.Errorf("invalid accountID format")
return "", fmt.Errorf("invalid accountID format: %q", accountID)

}

roleName := roleNameParts[1]

// STS ARN - arn:sts::<uid>:assumed-role/<role-name>/*
return fmt.Sprintf("arn:sts::%s:assumed-role/%s/*", mainAccountID, roleName), nil
}

return subParts[1], nil
return "", fmt.Errorf("invalid account type")
Copy link
Member

@rahmatrhd rahmatrhd Dec 24, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return "", fmt.Errorf("invalid account type")
return "", fmt.Errorf("invalid account type: %q", accountType)


}

func unmarshalPolicy(policy string) (Policy, error) {
Expand Down
Loading