From 265c31b714890c2e10eaa7520438ac66e15ba02a Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Thu, 12 Nov 2026 08:18:14 +0800 Subject: [PATCH] test(auth): cover STS tag counts before and after read permission Signed-off-by: Feng Ruohang --- cmd/sts-handlers_test.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/cmd/sts-handlers_test.go b/cmd/sts-handlers_test.go index d4bb043f8..bc5d9fd93 100644 --- a/cmd/sts-handlers_test.go +++ b/cmd/sts-handlers_test.go @@ -608,6 +608,13 @@ func (s *TestSuiteIAM) TestSTSWithTags(c *check) { // Validate sts creds can access the object c.mustPutObjectWithTags(ctx, minioClient, bucket, object) c.mustGetObject(ctx, minioClient, bucket, object) + // An object-tag condition does not grant permission to read the tags. + c.mustHeadObject(ctx, minioClient, bucket, object, 0) + tagReadPolicyBytes := bytes.Replace(policyBytes, []byte(`"s3:GetObject"`), + []byte(`["s3:GetObject", "s3:GetObjectTagging"]`), 1) + if err = s.adm.AddCannedPolicy(ctx, policy, tagReadPolicyBytes); err != nil { + c.Fatalf("unable to grant conditional tag read permission: %v", err) + } c.mustHeadObject(ctx, minioClient, bucket, object, 2) // Validate that the client can remove objects