astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-11-12 10:35:33 +03:00
Code Issues Packages Projects Releases Wiki Activity

test(auth): cover STS tag counts before and after read permission

Browse Source 
Signed-off-by: Feng Ruohang <rh@vonng.com>
This commit is contained in:
Feng Ruohang
2026-11-12 08:18:14 +08:00
parent 2ed720a7fb
commit 265c31b714
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/sts-handlers_test.go
+7
View File
@@ -608,6 +608,13 @@ func (s *TestSuiteIAM) TestSTSWithTags(c *check) {
// Validate sts creds can access the object // Validate sts creds can access the object
c.mustPutObjectWithTags(ctx, minioClient, bucket, object) c.mustPutObjectWithTags(ctx, minioClient, bucket, object)
c.mustGetObject(ctx, minioClient, bucket, object) c.mustGetObject(ctx, minioClient, bucket, object)
// An object-tag condition does not grant permission to read the tags.
c.mustHeadObject(ctx, minioClient, bucket, object, 0)
tagReadPolicyBytes := bytes.Replace(policyBytes, []byte(`"s3:GetObject"`),
[]byte(`["s3:GetObject", "s3:GetObjectTagging"]`), 1)
if err = s.adm.AddCannedPolicy(ctx, policy, tagReadPolicyBytes); err != nil {
c.Fatalf("unable to grant conditional tag read permission: %v", err)
}
c.mustHeadObject(ctx, minioClient, bucket, object, 2) c.mustHeadObject(ctx, minioClient, bucket, object, 2)
// Validate that the client can remove objects // Validate that the client can remove objects