Skip to content

Commit 7a08834

Browse files
aayushchouhan09aayushchouhan09
committed
Renamed to unified iam_inline_policies for containerized only
Signed-off-by: Aayush Chouhan <achouhan@redhat.com>
1 parent 8a58fdc commit 7a08834

9 files changed

Lines changed: 61 additions & 65 deletions

File tree

‎src/api/account_api.js‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1543,10 +1543,10 @@ module.exports = {
15431543
nsfs_account_config: {
15441544
$ref: 'common_api#/definitions/nsfs_account_config'
15451545
},
1546-
iam_user_policies: {
1546+
iam_inline_policies: {
15471547
type: 'array',
15481548
items: {
1549-
$ref: 'common_api#/definitions/iam_user_policy',
1549+
$ref: 'common_api#/definitions/iam_inline_policy',
15501550
}
15511551
},
15521552
owner: {
@@ -1644,10 +1644,10 @@ module.exports = {
16441644
owner_access_key: {
16451645
$ref: 'common_api#/definitions/access_key'
16461646
},
1647-
iam_role_policies: {
1647+
iam_inline_policies: {
16481648
type: 'array',
16491649
items: {
1650-
$ref: 'common_api#/definitions/iam_user_policy',
1650+
$ref: 'common_api#/definitions/iam_inline_policy',
16511651
}
16521652
}
16531653
}

‎src/api/common_api.js‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -591,7 +591,7 @@ module.exports = {
591591
}
592592
},
593593

594-
iam_user_policy: {
594+
iam_inline_policy: {
595595
type: 'object',
596596
required: ['policy_name', 'policy_document'],
597597
properties: {
@@ -601,7 +601,10 @@ module.exports = {
601601
}
602602
}
603603
},
604-
604+
// TODO: NC compatibility alias, remove after NC migrates to iam_inline_policy
605+
iam_user_policy: {
606+
$ref: '#/definitions/iam_inline_policy',
607+
},
605608
// IAM role trust policy (who can assume this role)
606609
iam_trust_policy_principal: {
607610
allOf: [{

‎src/endpoint/iam/iam_utils.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1360,11 +1360,11 @@ function _get_assumed_role_session_info(req) {
13601360
*/
13611361
async function _get_identity_policies(account, is_iam_user, assumed_role_arn, bucketspace) {
13621362
if (is_iam_user) {
1363-
return account.iam_user_policies || [];
1363+
return account.iam_inline_policies || [];
13641364
}
13651365
const resolved_role = await resolve_iam_role_by_arn(assumed_role_arn, bucketspace);
13661366
if (!resolved_role?.iam_role) return null;
1367-
return resolved_role.iam_role.iam_role_policies || [];
1367+
return resolved_role.iam_role.iam_inline_policies || [];
13681368
}
13691369

13701370
/**

‎src/sdk/nb.d.ts‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,11 +100,10 @@ interface Account extends Base {
100100
}>;
101101
master_key_id: ID;
102102
iam_path?: string;
103-
iam_user_policies?: object[];
103+
iam_inline_policies?: object[];
104104
description?: string;
105105
max_session_duration?: number;
106106
assume_role_policy_document?: object;
107-
iam_role_policies?: object[];
108107
creation_date?: Date;
109108
deleted?: Date;
110109
}

‎src/server/system_services/account_server.js‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1145,8 +1145,8 @@ function get_account_info(account, include_connection_cache) {
11451145
info.role_config = account.role_config;
11461146
info.force_md5_etag = account.force_md5_etag;
11471147

1148-
if (account.iam_user_policies) {
1149-
info.iam_user_policies = account.iam_user_policies;
1148+
if (account.iam_inline_policies) {
1149+
info.iam_inline_policies = account.iam_inline_policies;
11501150
}
11511151

11521152
return info;
@@ -1607,24 +1607,24 @@ async function put_user_policy(req) {
16071607
const requesting_account = req.account;
16081608
dbg.log1(`AccountSpaceNB.${action}`, req.rpc_params);
16091609
const requested_account = account_util.validate_and_return_requested_account(req.rpc_params, action, requesting_account);
1610-
const iam_user_policies = [...(requested_account.iam_user_policies || [])];
1611-
const index_of_iam_user_policy = account_util._get_iam_policy_index(iam_user_policies, req.rpc_params.policy_name);
1612-
const iam_user_policy_to_add = {
1610+
const iam_inline_policies = [...(requested_account.iam_inline_policies || [])];
1611+
const index_of_iam_inline_policy = account_util._get_iam_policy_index(iam_inline_policies, req.rpc_params.policy_name);
1612+
const iam_inline_policy_to_add = {
16131613
policy_name: req.rpc_params.policy_name,
16141614
policy_document: req.rpc_params.policy_document,
16151615
};
1616-
if (index_of_iam_user_policy === -1) {
1617-
iam_user_policies.push(iam_user_policy_to_add);
1616+
if (index_of_iam_inline_policy === -1) {
1617+
iam_inline_policies.push(iam_inline_policy_to_add);
16181618
} else {
1619-
iam_user_policies[index_of_iam_user_policy] = iam_user_policy_to_add;
1619+
iam_inline_policies[index_of_iam_inline_policy] = iam_inline_policy_to_add;
16201620
}
16211621

1622-
account_util._check_total_policy_size(iam_user_policies, req.rpc_params.username);
1622+
account_util._check_total_policy_size(iam_inline_policies, req.rpc_params.username);
16231623
await system_store.make_changes({
16241624
update: {
16251625
accounts: [{
16261626
_id: requested_account._id,
1627-
$set: { iam_user_policies },
1627+
$set: { iam_inline_policies },
16281628
}]
16291629
}
16301630
});
@@ -1635,12 +1635,12 @@ async function get_user_policy(req) {
16351635
dbg.log1(`AccountSpaceNB.${action}`, req.rpc_params);
16361636
const requesting_account = req.account;
16371637
const requested_account = account_util.validate_and_return_requested_account(req.rpc_params, action, requesting_account);
1638-
const iam_user_policies = requested_account.iam_user_policies || [];
1639-
const iam_user_policy_index = account_util._check_iam_policy_exists(action, iam_user_policies, req.rpc_params.policy_name);
1638+
const iam_inline_policies = requested_account.iam_inline_policies || [];
1639+
const iam_inline_policy_index = account_util._check_iam_policy_exists(action, iam_inline_policies, req.rpc_params.policy_name);
16401640
return {
16411641
username: req.rpc_params.username,
16421642
policy_name: req.rpc_params.policy_name,
1643-
policy_document: JSON.stringify(iam_user_policies[iam_user_policy_index].policy_document),
1643+
policy_document: JSON.stringify(iam_inline_policies[iam_inline_policy_index].policy_document),
16441644
};
16451645
}
16461646

@@ -1649,15 +1649,15 @@ async function delete_user_policy(req) {
16491649
dbg.log1(`AccountSpaceNB.${action}`, req.rpc_params);
16501650
const requesting_account = req.account;
16511651
const requested_account = account_util.validate_and_return_requested_account(req.rpc_params, action, requesting_account);
1652-
const iam_user_policies = [...(requested_account.iam_user_policies || [])];
1653-
const iam_user_policy_index = account_util._check_iam_policy_exists(action, iam_user_policies, req.rpc_params.policy_name);
1654-
iam_user_policies.splice(iam_user_policy_index, 1);
1652+
const iam_inline_policies = [...(requested_account.iam_inline_policies || [])];
1653+
const iam_inline_policy_index = account_util._check_iam_policy_exists(action, iam_inline_policies, req.rpc_params.policy_name);
1654+
iam_inline_policies.splice(iam_inline_policy_index, 1);
16551655

16561656
await system_store.make_changes({
16571657
update: {
16581658
accounts: [{
16591659
_id: requested_account._id,
1660-
$set: { iam_user_policies },
1660+
$set: { iam_inline_policies },
16611661
}]
16621662
}
16631663
});
@@ -1670,7 +1670,7 @@ async function list_user_policies(req) {
16701670
const requested_account = account_util.validate_and_return_requested_account(req.rpc_params, action, requesting_account);
16711671
// TODO: Pagination not supported - currently returns all user policies, ignoring marker and max_items params
16721672
const is_truncated = false;
1673-
let members = _.map(requested_account.iam_user_policies || [], iam_user_policy => iam_user_policy.policy_name);
1673+
let members = _.map(requested_account.iam_inline_policies || [], iam_inline_policy => iam_inline_policy.policy_name);
16741674
members = members.sort((a, b) => a.localeCompare(b));
16751675
return {
16761676
is_truncated,
@@ -1751,7 +1751,7 @@ function _return_iam_role_info(iam_role, account_id) {
17511751
description: iam_role.description,
17521752
max_session_duration: iam_role.max_session_duration,
17531753
owner_access_key: owner_account?.access_keys?.[0]?.access_key,
1754-
iam_role_policies: iam_role.iam_role_policies,
1754+
iam_inline_policies: iam_role.iam_inline_policies,
17551755
};
17561756
}
17571757

@@ -1782,7 +1782,7 @@ async function create_role(req) {
17821782
description: req.rpc_params.description,
17831783
max_session_duration: req.rpc_params.max_session_duration ?? DEFAULT_MAX_SESSION_DURATION_SECS,
17841784
assume_role_policy_document: req.rpc_params.assume_role_policy_document,
1785-
iam_role_policies: [],
1785+
iam_inline_policies: [],
17861786
creation_date: Date.now(),
17871787
}, _.isUndefined);
17881788
await system_store.make_changes({ insert: { accounts: [new_role] } });
@@ -1824,7 +1824,7 @@ async function delete_role(req) {
18241824
{ role_name: req.rpc_params.role_name, path: IAM_DEFAULT_PATH }, 'ROLE');
18251825
const role_to_delete = _get_iam_role_by_name_or_throw(
18261826
req.rpc_params.role_name, requesting_account._id);
1827-
if ((role_to_delete.iam_role_policies || []).length > 0) {
1827+
if ((role_to_delete.iam_inline_policies || []).length > 0) {
18281828
account_util._throw_error_delete_conflict(action, role_to_delete, 'policies');
18291829
}
18301830
await system_store.make_changes({ remove: { accounts: [role_to_delete._id] } });
@@ -1854,17 +1854,17 @@ async function put_role_policy(req) {
18541854
{ role_name: req.rpc_params.role_name, path: IAM_DEFAULT_PATH }, 'ROLE');
18551855
const role_to_update = _get_iam_role_by_name_or_throw(
18561856
req.rpc_params.role_name, requesting_account._id);
1857-
const iam_role_policies = [...(role_to_update.iam_role_policies || [])];
1858-
const policy_index = account_util._get_iam_policy_index(iam_role_policies, req.rpc_params.policy_name);
1857+
const iam_inline_policies = [...(role_to_update.iam_inline_policies || [])];
1858+
const policy_index = account_util._get_iam_policy_index(iam_inline_policies, req.rpc_params.policy_name);
18591859
const policy = {
18601860
policy_name: req.rpc_params.policy_name,
18611861
policy_document: req.rpc_params.policy_document,
18621862
};
1863-
if (policy_index === -1) iam_role_policies.push(policy);
1864-
else iam_role_policies[policy_index] = policy;
1865-
account_util._check_total_policy_size(iam_role_policies, req.rpc_params.role_name, 'role');
1863+
if (policy_index === -1) iam_inline_policies.push(policy);
1864+
else iam_inline_policies[policy_index] = policy;
1865+
account_util._check_total_policy_size(iam_inline_policies, req.rpc_params.role_name, 'role');
18661866
await system_store.make_changes({
1867-
update: { accounts: [{ _id: role_to_update._id, $set: { iam_role_policies } }] }
1867+
update: { accounts: [{ _id: role_to_update._id, $set: { iam_inline_policies } }] }
18681868
});
18691869
}
18701870

@@ -1875,13 +1875,13 @@ async function get_role_policy(req) {
18751875
{ role_name: req.rpc_params.role_name, path: IAM_DEFAULT_PATH }, 'ROLE');
18761876
const requested_role = _get_iam_role_by_name_or_throw(
18771877
req.rpc_params.role_name, requesting_account._id);
1878-
const iam_role_policies = requested_role.iam_role_policies || [];
1878+
const iam_inline_policies = requested_role.iam_inline_policies || [];
18791879
const policy_index = account_util._check_iam_policy_exists(
1880-
action, iam_role_policies, req.rpc_params.policy_name, 'role');
1880+
action, iam_inline_policies, req.rpc_params.policy_name, 'role');
18811881
return {
18821882
role_name: req.rpc_params.role_name,
18831883
policy_name: req.rpc_params.policy_name,
1884-
policy_document: JSON.stringify(iam_role_policies[policy_index].policy_document),
1884+
policy_document: JSON.stringify(iam_inline_policies[policy_index].policy_document),
18851885
};
18861886
}
18871887

@@ -1892,12 +1892,12 @@ async function delete_role_policy(req) {
18921892
{ role_name: req.rpc_params.role_name, path: IAM_DEFAULT_PATH }, 'ROLE');
18931893
const role_to_delete = _get_iam_role_by_name_or_throw(
18941894
req.rpc_params.role_name, requesting_account._id);
1895-
const iam_role_policies = [...(role_to_delete.iam_role_policies || [])];
1895+
const iam_inline_policies = [...(role_to_delete.iam_inline_policies || [])];
18961896
const policy_index = account_util._check_iam_policy_exists(
1897-
action, iam_role_policies, req.rpc_params.policy_name, 'role');
1898-
iam_role_policies.splice(policy_index, 1);
1897+
action, iam_inline_policies, req.rpc_params.policy_name, 'role');
1898+
iam_inline_policies.splice(policy_index, 1);
18991899
await system_store.make_changes({
1900-
update: { accounts: [{ _id: role_to_delete._id, $set: { iam_role_policies } }] }
1900+
update: { accounts: [{ _id: role_to_delete._id, $set: { iam_inline_policies } }] }
19011901
});
19021902
}
19031903

@@ -1909,7 +1909,7 @@ async function list_role_policies(req) {
19091909
// TODO: Pagination not supported - currently returns all role policies, ignoring marker and max_items params
19101910
const requested_role = _get_iam_role_by_name_or_throw(
19111911
req.rpc_params.role_name, requesting_account._id);
1912-
const members = _.map(requested_role.iam_role_policies || [], p => p.policy_name)
1912+
const members = _.map(requested_role.iam_inline_policies || [], p => p.policy_name)
19131913
.sort((a, b) => a.localeCompare(b));
19141914
return { is_truncated: false, members };
19151915
}

‎src/server/system_services/schemas/account_schema.js‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,10 @@ module.exports = {
3535
$ref: 'common_api#/definitions/tagging',
3636
},
3737
iam_path: { type: 'string' },
38-
iam_user_policies: {
38+
iam_inline_policies: {
3939
type: 'array',
4040
items: {
41-
$ref: 'common_api#/definitions/iam_user_policy',
41+
$ref: 'common_api#/definitions/iam_inline_policy',
4242
}
4343
},
4444

@@ -54,12 +54,6 @@ module.exports = {
5454
assume_role_policy_document: {
5555
$ref: 'common_api#/definitions/iam_trust_policy_document',
5656
},
57-
iam_role_policies: {
58-
type: 'array',
59-
items: {
60-
$ref: 'common_api#/definitions/iam_user_policy',
61-
}
62-
},
6357
creation_date: { idate: true },
6458
// default policy for new buckets
6559
default_resource: { objectid: true },

‎src/test/integration_tests/internal/test_upgrade_scripts.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -459,7 +459,7 @@ mocha.describe('test upgrade_iam_role script 5.23.0', async function() {
459459
assert.strictEqual(role.iam_path, '/');
460460
assert.strictEqual(role.description, 'Migrated from account');
461461
assert.strictEqual(role.max_session_duration, DEFAULT_MAX_SESSION_DURATION_SECS);
462-
assert.deepStrictEqual(role.iam_role_policies, []);
462+
assert.deepStrictEqual(role.iam_inline_policies, []);
463463

464464
// Verify statement mapping
465465
const stmt = role.assume_role_policy_document.Statement[0];
@@ -709,7 +709,7 @@ mocha.describe('test upgrade_iam_role script 5.23.0', async function() {
709709
description: sentinel_description,
710710
max_session_duration: DEFAULT_MAX_SESSION_DURATION_SECS,
711711
assume_role_policy_document: { Statement: [] },
712-
iam_role_policies: [],
712+
iam_inline_policies: [],
713713
creation_date: Date.now(),
714714
}]
715715
}
@@ -829,7 +829,7 @@ mocha.describe('test upgrade_iam_role script 5.23.0', async function() {
829829
description: 'other-owner-sentinel',
830830
max_session_duration: DEFAULT_MAX_SESSION_DURATION_SECS,
831831
assume_role_policy_document: { Statement: [] },
832-
iam_role_policies: [],
832+
iam_inline_policies: [],
833833
creation_date: Date.now(),
834834
}]
835835
}

‎src/upgrade/upgrade_scripts/5.23.0/upgrade_iam_roles.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ async function run({ dbg, system_store, system_server }) {
6666
description: "Migrated from account",
6767
max_session_duration: max_session_duration,
6868
assume_role_policy_document: new_policy,
69-
iam_role_policies: [],
69+
iam_inline_policies: [],
7070
creation_date: Date.now(),
7171
}, _.isUndefined);
7272

‎src/util/account_util.js‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -356,7 +356,7 @@ function _get_identity_type(identity) {
356356
const identity_type = identity.identity_type || identity.type;
357357
if (identity_type) return String(identity_type).toUpperCase();
358358
const identity_email = _get_identity_email(identity);
359-
if ((!_.isUndefined(identity.assume_role_policy_document) || !_.isUndefined(identity.iam_role_policies)) &&
359+
if ((!_.isUndefined(identity.assume_role_policy_document) || !_.isUndefined(identity.iam_inline_policies)) &&
360360
(_.isUndefined(identity_email) || _is_role_identity_email(identity_email))) {
361361
return IDENTITY_TYPES.ROLE;
362362
}
@@ -671,19 +671,19 @@ function _get_iam_policy_index(iam_policies, policy_name) {
671671
return iam_policy_index;
672672
}
673673

674-
function _check_total_policy_size(iam_user_policies, username, entity = 'user') {
675-
const total_chars_size = _get_total_size_of_policies(iam_user_policies);
674+
function _check_total_policy_size(iam_policies, username, entity = 'user') {
675+
const total_chars_size = _get_total_size_of_policies(iam_policies);
676676
if (total_chars_size > AWS_LIMIT_CHARS_INLINE_POLICY) {
677677
const message_with_details = `Maximum policy size of ${AWS_LIMIT_CHARS_INLINE_POLICY} bytes exceeded for ${entity} ${username}`;
678678
throw new RpcError('LIMIT_EXCEEDED', message_with_details);
679679
}
680680
}
681681

682682
// each char is byte and not including whitespaces
683-
function _get_total_size_of_policies(iam_user_policies) {
683+
function _get_total_size_of_policies(iam_policies) {
684684
let total_size = 0;
685-
for (const iam_user_policy of iam_user_policies) {
686-
const policy_as_string = JSON.stringify(iam_user_policy);
685+
for (const iam_policy of iam_policies) {
686+
const policy_as_string = JSON.stringify(iam_policy);
687687
total_size += policy_as_string.length;
688688
}
689689
return total_size;
@@ -706,8 +706,8 @@ function _check_if_user_does_not_have_access_keys_before_deletion(action, accoun
706706

707707
function _check_if_user_does_not_have_user_policy_before_deletion(action, account_to_delete) {
708708
const resource_name = 'policies';
709-
const iam_user_policies = account_to_delete.iam_user_policies || [];
710-
const is_policies_removed = iam_user_policies.length === 0;
709+
const iam_inline_policies = account_to_delete.iam_inline_policies || [];
710+
const is_policies_removed = iam_inline_policies.length === 0;
711711
if (!is_policies_removed) {
712712
_throw_error_delete_conflict(action, account_to_delete, resource_name);
713713
}

0 commit comments

Comments
 (0)