IAM User Inline Policy With Bucket Policy

[shirady]

Environment info

• NooBaa Version: 4.23 (current master)
• Platform: not relevant - containerized (in NC, we don't have IAM user inline policy)

Actual behavior

Currently, in S3 rest we ask for IAM policy AND bucket policy for all IAM users:

noobaa-core/src/endpoint/s3/s3_rest.js

Lines 235 to 238 in ae08790

	await authorize_request_iam_policy(req); // authorize_request_iam_policy(req) is for users only
	// authorize_request_policy(req) is supposed to
	// allow owners access unless there is an explicit DENY policy
	await authorize_request_policy(req);

Expected behavior

• Cross accounts (IAM users in another account) - the current behavior is as expected.
• Same account (IAM users under the account) - having the permission only in one layer is enough.

From AWS docs (link):

For IAM users and role principals within your account, no other permissions are required. For principals in other accounts, they must also have identity-based permissions in their account that allow them to access your resource. This is called cross-account access.

Steps to reproduce

Cross account case
(should work as expected) - need bucket policy AND IAM user inline policy

Same account case

1. Create an IAM User and access key (no IAM user line permission).

2. Create a bucket in the account and add an object

3. Add a bucket policy on the principal of the user using ARN and a specific action

4. Try to use the IAM user with the specific action using AWS CLI: in AWS should succeed; in our current implementation, you would need to add an IAM inline policy for this.

5. More information - Screenshots / Logs / Other output

• Probably also impacts role inline policy
• Probably also impacts other services in NooBaa (Vectors, STS).

For example: in vector rest:

noobaa-core/src/endpoint/vector/vector_rest.js

Lines 205 to 206 in ae08790

	await authorize_request_iam_policy(req);
	await authorize_request_vector_policy(req);

[coderabbitai]

🔗 Related PRs

#9281 - IAM | Authorize Requests for IAM Users According to IAM User Inline Policy [merged]
#9285 - IAM | Doc | User Inline Policy Documentation [merged]
#9291 - IAM | No Bucket Policy Authorization for IAM Users [merged]
#9302 - IAM | Change Default Behavior of Users Without IAM User Policy [merged]
#9307 - IAM | User Without IAM User Policy Improve Error Message [merged]
#9312 - IAM | Principal in Bucket Policy of the Account Root User When the Requesting Account Is IAM User [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!