crud operations + assume role - #9865
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughIAM role support is added to ConfigFS and account-space APIs. NC-specific role resolution is wired into STS, IAM authorization, and assume-role policy retrieval. Account schema fields and SDK request wiring are updated. ChangesIAM roles and NC integration
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant StsSDK
participant AccountSpaceFS
participant IAMAuthorization
Client->>StsSDK: Assume role
StsSDK->>AccountSpaceFS: Resolve role ARN
AccountSpaceFS-->>StsSDK: Role, account, and access-key data
StsSDK-->>Client: Assumed-role credentials and trust policy
IAMAuthorization->>AccountSpaceFS: Resolve assumed-role identity policies
AccountSpaceFS-->>IAMAuthorization: Role policy data
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
src/sdk/accountspace_fs.js (1)
718-720: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider sorting
list_rolesmembers for stable output.
list_userssorts members by username before returning;list_rolesreturns filesystem order. Sorting byrole_namekeeps listing deterministic and consistent with the users path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/sdk/accountspace_fs.js` around lines 718 - 720, Update list_roles to sort the members returned by _list_config_files_for_roles by role_name before constructing the result. Preserve the existing is_truncated value and return shape while ensuring deterministic ordering consistent with list_users.src/endpoint/sts/sts_rest.js (1)
242-248: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valuePrefer reusing
parse_role_arnover ad-hoc ARN slicing.The NC branch re-parses the ARN by hand (
slice/split(':')[4]) while the non-NC branch below relies onresolve_iam_role_by_arn(which usesparse_role_arn). Reusing the shared parser avoids divergent handling of paths in the ARN and malformed inputs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/endpoint/sts/sts_rest.js` around lines 242 - 248, Update the NC branch around role_name and account_id to reuse parse_role_arn instead of manually slicing role_arn and splitting its account segment. Use the parser’s extracted role name and account ID when calling config_fs.get_role_by_name, preserving the existing assume_role_policy_document return behavior.src/server/system_services/schemas/nsfs_account_schema.js (1)
10-15: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚖️ Poor tradeoffLoosening
requiredon the shared account schema weakens validation for real accounts.Since this schema is reused for roles, dropping
access_keys, andmaster_key_idfromrequiredlets role data validate — but it also stops enforcing these on genuine account configs written viacreate_account_config_file/_prepare_for_account_schema. Consider a dedicatedrole_schema(or aoneOf) so account invariants stay enforced while roles validate against role-appropriate requirements.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/server/system_services/schemas/nsfs_account_schema.js` around lines 10 - 15, Preserve required validation for genuine account configurations while allowing role data to validate: update the shared account-schema usage around nsfs_account_config and the create_account_config_file/_prepare_for_account_schema flow to distinguish account and role validation, using a dedicated role_schema or an appropriate oneOf. Keep email, access_keys, and master_key_id required for account configs, while defining only role-appropriate requirements for roles.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/sdk/accountspace_fs.js`:
- Around line 679-681: Remove the unused role_data_updated assignment and ARN
computation from update_role, while preserving the await of
update_role_config_file and its existing empty-object return value. Do not alter
the update operation’s behavior.
In `@src/sdk/sts_sdk.js`:
- Around line 104-109: The _get_role_containerized return path must guard
against missing owner access keys and support both string and SensitiveString
values. Mirror _get_role_nc by checking access_keys?.length before indexing,
then normalize the first access_key with a string check or unwrap; preserve the
existing ACCESS_DENIED/NO_SUCH_ACCOUNT error behavior for malformed owners.
In `@src/server/system_services/schemas/nsfs_account_schema.js`:
- Around line 120-122: Update the role default handling associated with
assume_role_policy_document and _new_role_defaults so an omitted policy is not
defaulted to an empty object. Use undefined or validate the supplied parameter
before nsfs_schema_utils.validate_account_schema, allowing CreateRole’s IAM
policy-document validation error instead of INVALID_SCHEMA from the NC schema.
---
Nitpick comments:
In `@src/endpoint/sts/sts_rest.js`:
- Around line 242-248: Update the NC branch around role_name and account_id to
reuse parse_role_arn instead of manually slicing role_arn and splitting its
account segment. Use the parser’s extracted role name and account ID when
calling config_fs.get_role_by_name, preserving the existing
assume_role_policy_document return behavior.
In `@src/sdk/accountspace_fs.js`:
- Around line 718-720: Update list_roles to sort the members returned by
_list_config_files_for_roles by role_name before constructing the result.
Preserve the existing is_truncated value and return shape while ensuring
deterministic ordering consistent with list_users.
In `@src/server/system_services/schemas/nsfs_account_schema.js`:
- Around line 10-15: Preserve required validation for genuine account
configurations while allowing role data to validate: update the shared
account-schema usage around nsfs_account_config and the
create_account_config_file/_prepare_for_account_schema flow to distinguish
account and role validation, using a dedicated role_schema or an appropriate
oneOf. Keep email, access_keys, and master_key_id required for account configs,
while defining only role-appropriate requirements for roles.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 582b01cf-9c68-4593-bec5-d1ad18d8c2be
📒 Files selected for processing (7)
src/endpoint/iam/iam_utils.jssrc/endpoint/sts/sts_rest.jssrc/manage_nsfs/nsfs_schema_utils.jssrc/sdk/accountspace_fs.jssrc/sdk/config_fs.jssrc/sdk/sts_sdk.jssrc/server/system_services/schemas/nsfs_account_schema.js
alphaprinz
left a comment
alphaprinz
left a comment
There was a problem hiding this comment.
I would like to have sts_rest route logic to accountspace_nb/fs, rather than using is_nc_env() function.
Also didn't understand why we removed account fields from the schema. We still use the same schema for account json, right?
|
|
||
| const { account_id, role_name } = parsed; | ||
|
|
||
| if (is_nc_environment()) { |
There was a problem hiding this comment.
I think delegating this function to namesapce/accountspace_nb/fs would be nicer than this if.
| const role_arn = req.body.role_arn; | ||
| const role_name = role_arn.slice(role_arn.lastIndexOf('/') + 1); | ||
|
|
||
| if (is_nc_environment()) { |
There was a problem hiding this comment.
Move to namespace/accountspace impl, take 3 :)
There was a problem hiding this comment.
Done for NC via sts_sdk → accountspace; containerized path unchanged.
There was a problem hiding this comment.
The point is not to have is_nc_env() when we have AccountSpace_NB and AccountSpace_FS.
iam_utils.resolve_iam_role_by_arn() should be moved to AccountSpace_NB.
sts_rest.get_assume_role_policy() should use a virtual req.accountsdk.accountspace.resolve_role_by_arn().
@shirady again, WDYT?
There was a problem hiding this comment.
@alphaprinz sounds good.
Adding @naveenpaul1 @VershaAgrawal @aayushchouhan09 .
ac66287 to
f4194b6
Compare
f4194b6 to
c4dd86f
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/sdk/nsfs_object_sdk.js (1)
9-32: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winResolve
fs_rootintoAccountSpaceFS’ config root for simple-mode NSFS.In the
elsebranch,new AccountSpaceFS({ fs_root })ignoresfs_root;AccountSpaceFSonly usesconfig_rootto constructConfigFS, so IAM/STS role and access-key lookups read from the default NC config location (NSFS_NC_DEFAULT_CONF_DIR) instead of this simple-mode NSFS endpoint’sfs_root. Passfs_rootas the config root, or route accounts overfs_rootthrough a simple-mode accountspace.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/sdk/nsfs_object_sdk.js` around lines 9 - 32, Update the simple-mode branch of NsfsObjectSDK’s constructor to initialize AccountSpaceFS with fs_root as its config_root, ensuring IAM, STS role, and access-key lookups use the endpoint’s configured root instead of the default NC configuration directory. Leave the config_root branch unchanged.
🧹 Nitpick comments (1)
src/endpoint/iam/iam_utils.js (1)
1343-1356: 🔒 Security & Privacy | 🔵 TrivialNC empty-policy allow now also covers assumed-role sessions.
The fast-path bypass for zero inline policies is widened to
is_iam_user || is_assumed_role_sessionunder NC (req.object_sdk.nsfs_config_root). This matches the PR's stated Phase-1 scope (empty-policy allow pending PutRolePolicy/Phase 2) and is already tracked via the inline TODO, so flagging only for visibility — happy to help wire this up once role inline policies (Phase 2) land, if useful.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/endpoint/iam/iam_utils.js` around lines 1343 - 1356, The empty inline-policy fast path in the IAM authorization flow now intentionally allows assumed-role sessions under NC. Preserve the condition in authorize_request_iam_policy using req.object_sdk.nsfs_config_root and the is_iam_user || is_assumed_role_session check, along with its existing Phase-2 TODO; no code change is required.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/sdk/nsfs_object_sdk.js`:
- Around line 9-32: Update the simple-mode branch of NsfsObjectSDK’s constructor
to initialize AccountSpaceFS with fs_root as its config_root, ensuring IAM, STS
role, and access-key lookups use the endpoint’s configured root instead of the
default NC configuration directory. Leave the config_root branch unchanged.
---
Nitpick comments:
In `@src/endpoint/iam/iam_utils.js`:
- Around line 1343-1356: The empty inline-policy fast path in the IAM
authorization flow now intentionally allows assumed-role sessions under NC.
Preserve the condition in authorize_request_iam_policy using
req.object_sdk.nsfs_config_root and the is_iam_user || is_assumed_role_session
check, along with its existing Phase-2 TODO; no code change is required.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 4a6f6390-db94-45d1-9346-b04f79d0679f
📒 Files selected for processing (11)
src/cmd/nsfs.jssrc/endpoint/iam/iam_utils.jssrc/endpoint/sts/sts_rest.jssrc/manage_nsfs/nsfs_schema_utils.jssrc/sdk/accountspace_fs.jssrc/sdk/config_fs.jssrc/sdk/nsfs_object_sdk.jssrc/sdk/object_sdk.jssrc/sdk/sts_sdk.jssrc/server/system_services/schemas/nsfs_account_schema.jssrc/test/unit_tests/nsfs/test_accountspace_fs.test.js
🚧 Files skipped from review as they are similar to previous changes (4)
- src/server/system_services/schemas/nsfs_account_schema.js
- src/manage_nsfs/nsfs_schema_utils.js
- src/sdk/accountspace_fs.js
- src/sdk/config_fs.js
45ca4a4 to
00d8255
Compare
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/sdk/accountspace_fs.js`:
- Around line 733-738: Update get_role_by_arn to validate that the parsed ARN
represents the IAM service and has a role/ resource type before calling
config_fs.get_role_by_name. Return the parser’s existing error response for
non-role ARN values, while preserving the current filesystem lookup for valid
role ARNs.
- Around line 673-680: Prevent lost updates between update_role and
update_assume_role_policy by changing the role metadata update flow around
update_role_config_file to use compare-and-swap, per-role locking, or
field-level merge semantics. Ensure concurrent updates preserve
assume_role_policy_document when UpdateRole changes description or
max_session_duration, and preserve those metadata fields when
UpdateAssumeRolePolicy changes the policy. Apply the corresponding fix at
src/sdk/accountspace_fs.js lines 673-680 and 791-797.
- Around line 604-615: Update create_role around is_role_exists_by_name,
list_roles_under_account, and create_role_config_file to reserve the role name
atomically while writing the role configuration. Move name-conflict and
per-account quota enforcement into the same exclusive write/creation operation,
preserving EntityAlreadyExists and LimitExceeded errors, so concurrent requests
cannot bypass either check.
In
`@src/test/unit_tests/nc/configuration/test_nc_nsfs_account_schema_validation.test.js`:
- Around line 180-214: Replace the commented-out required-field tests in the
account schema validation suite with active coverage for the optional-field
contract. Add a role-shaped fixture that omits email, access_keys,
allow_bucket_creation, and master_key_id, then assert validate_account_schema()
accepts it; apply the same coverage to the related commented sections without
preserving obsolete missing-property expectations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 2e8b9ccb-0639-4bc6-948f-4c3109d14027
📒 Files selected for processing (12)
src/cmd/nsfs.jssrc/endpoint/iam/iam_utils.jssrc/endpoint/sts/sts_rest.jssrc/manage_nsfs/nsfs_schema_utils.jssrc/sdk/accountspace_fs.jssrc/sdk/config_fs.jssrc/sdk/nsfs_object_sdk.jssrc/sdk/object_sdk.jssrc/sdk/sts_sdk.jssrc/server/system_services/schemas/nsfs_account_schema.jssrc/test/unit_tests/nc/configuration/test_nc_nsfs_account_schema_validation.test.jssrc/test/unit_tests/nsfs/test_accountspace_fs.test.js
🚧 Files skipped from review as they are similar to previous changes (10)
- src/cmd/nsfs.js
- src/manage_nsfs/nsfs_schema_utils.js
- src/endpoint/sts/sts_rest.js
- src/sdk/object_sdk.js
- src/sdk/nsfs_object_sdk.js
- src/endpoint/iam/iam_utils.js
- src/server/system_services/schemas/nsfs_account_schema.js
- src/sdk/sts_sdk.js
- src/test/unit_tests/nsfs/test_accountspace_fs.test.js
- src/sdk/config_fs.js
| async get_role_by_arn(params) { | ||
| const parsed = parse_role_arn(params.role_arn); | ||
| if (parsed.error) return { error: parsed.error }; | ||
| const { account_id, role_name } = parsed; | ||
| const iam_role = await this.config_fs.get_role_by_name(role_name, account_id, { silent_if_missing: true }); | ||
| if (!iam_role) return { error: 'NO_SUCH_ROLE', account_id, role_name }; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Reject ARN values that do not identify an IAM role.
parse_role_arn() extracts only the account ID and final path segment. A value such as arn:aws:iam::ACCOUNT_ID:user/ROLE_NAME can resolve as role ROLE_NAME when that role exists. Validate the service and role/ resource type before the filesystem lookup.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/sdk/accountspace_fs.js` around lines 733 - 738, Update get_role_by_arn to
validate that the parsed ARN represents the IAM service and has a role/ resource
type before calling config_fs.get_role_by_name. Return the parser’s existing
error response for non-role ARN values, while preserving the current filesystem
lookup for valid role ARNs.
| // it('account without email', () => { | ||
| // const account_data = get_account_data(); | ||
| // delete account_data.email; | ||
| // const reason = 'Test should have failed because of missing required property ' + | ||
| // 'email'; | ||
| // const message = "must have required property 'email'"; | ||
| // assert_validation(account_data, reason, message); | ||
| // }); | ||
|
|
||
| // it('account with undefined email', () => { | ||
| // const account_data = get_account_data(); | ||
| // account_data.email = undefined; | ||
| // const reason = 'Test should have failed because of missing required property ' + | ||
| // 'email'; | ||
| // const message = "must have required property 'email'"; | ||
| // assert_validation(account_data, reason, message); | ||
| // }); | ||
|
|
||
| // it('account without access_keys', () => { | ||
| // const account_data = get_account_data(); | ||
| // delete account_data.access_keys; | ||
| // const reason = 'Test should have failed because of missing required property ' + | ||
| // 'access_keys'; | ||
| // const message = "must have required property 'access_keys'"; | ||
| // assert_validation(account_data, reason, message); | ||
| // }); | ||
|
|
||
| // it('account with undefined access_keys', () => { | ||
| // const account_data = get_account_data(); | ||
| // account_data.access_keys = undefined; | ||
| // const reason = 'Test should have failed because of missing required property ' + | ||
| // 'access_keys'; | ||
| // const message = "must have required property 'access_keys'"; | ||
| // assert_validation(account_data, reason, message); | ||
| // }); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Add active tests for the new optional-field contract.
These comments remove validation coverage for email, access_keys, allow_bucket_creation, and master_key_id. Add a role-shaped fixture that omits these fields and assert that validate_account_schema() accepts it. This protects the role schema contract without retaining obsolete account-only requirements.
As per path instructions, src/test/**/*.* must include tests for the changes.
Also applies to: 308-324, 344-360
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@src/test/unit_tests/nc/configuration/test_nc_nsfs_account_schema_validation.test.js`
around lines 180 - 214, Replace the commented-out required-field tests in the
account schema validation suite with active coverage for the optional-field
contract. Add a role-shaped fixture that omits email, access_keys,
allow_bucket_creation, and master_key_id, then assert validate_account_schema()
accepts it; apply the same coverage to the related commented sections without
preserving obsolete missing-property expectations.
Source: Path instructions
3dbd3a8 to
ef89c33
Compare
| // 2 - verify role_name is unique under the account | ||
| // 3 - enforce per-account role limit | ||
| // 4 - write role identity.json + symlink | ||
| async create_role(params, account_sdk) { |
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
There was a problem hiding this comment.
LDAP changes will be there in next PR, this PR is only for role APIs and basic STS assume role
ef89c33 to
5c5b4ce
Compare
alphaprinz
left a comment
alphaprinz
left a comment
There was a problem hiding this comment.
I still think we can remove the is_nc_env() if we move the resolve_role_by_arn to accountspace. I'll ask Shira to also weigh in on this. Please let me know if you think it's problematic. I think it will give us cleaner code.
| * @returns {Promise<object[]|null>} policies, or null if assumed role could not be resolved | ||
| */ | ||
| async function _get_identity_policies(account, is_iam_user, assumed_role_arn, bucketspace) { | ||
| async function _get_identity_policies(account, is_iam_user, assumed_role_arn, bucketspace, object_sdk) { |
There was a problem hiding this comment.
Lets move iam_utils.resolve_iam_role_by_arn() to accountspace_nb.
That way we have the nb-only iam_utils.resolve_iam_role_by_arn() in an nb-only file.
And then we can skip the 'object_sdk?.accountspace ?' test.
It does mean you need to pass account_sdk to _get_identity_policies(), possibly from req.
@shirady WDYT?
There was a problem hiding this comment.
@alphaprinz I'm fine with what you're suggesting.
I think it is more relevant to you @naveenpaul1 @VershaAgrawal @aayushchouhan09.
| const role_arn = req.body.role_arn; | ||
| const role_name = role_arn.slice(role_arn.lastIndexOf('/') + 1); | ||
|
|
||
| if (is_nc_environment()) { |
There was a problem hiding this comment.
The point is not to have is_nc_env() when we have AccountSpace_NB and AccountSpace_FS.
iam_utils.resolve_iam_role_by_arn() should be moved to AccountSpace_NB.
sts_rest.get_assume_role_policy() should use a virtual req.accountsdk.accountspace.resolve_role_by_arn().
@shirady again, WDYT?
| * @returns {Promise<Object>} | ||
| */ | ||
| async _assume_role(role_arn) { | ||
| const role_response = await (is_nc_environment() ? |
There was a problem hiding this comment.
Same here for is_nc_env()
| * @returns {Promise<object[]|null>} policies, or null if assumed role could not be resolved | ||
| */ | ||
| async function _get_identity_policies(account, is_iam_user, assumed_role_arn, bucketspace) { | ||
| async function _get_identity_policies(account, is_iam_user, assumed_role_arn, bucketspace, object_sdk) { |
There was a problem hiding this comment.
@alphaprinz I'm fine with what you're suggesting.
I think it is more relevant to you @naveenpaul1 @VershaAgrawal @aayushchouhan09.
| const role_arn = req.body.role_arn; | ||
| const role_name = role_arn.slice(role_arn.lastIndexOf('/') + 1); | ||
|
|
||
| if (is_nc_environment()) { |
There was a problem hiding this comment.
@alphaprinz sounds good.
Adding @naveenpaul1 @VershaAgrawal @aayushchouhan09 .
5c5b4ce to
9cc5b84
Compare
alphaprinz
left a comment
alphaprinz
left a comment
There was a problem hiding this comment.
Found some things that can be removed.
Otherwise LGTM :)
| const message = "must have required property 'access_keys'"; | ||
| assert_validation(account_data, reason, message); | ||
| }); | ||
| // it('account without access_keys', () => { |
There was a problem hiding this comment.
I don't see a point in keeping the commented-out code.
We can add a comment explaining why these fields are not mandatory for account.
There was a problem hiding this comment.
yes, just wanted to get the review from @shirady if these required fields can be removed. If yes, then will be removing these
| this.object_io = object_io; | ||
| this.stats = stats; | ||
| this.bucketspace = bucketspace || new BucketSpaceNB({ rpc_client, internal_rpc_client }); | ||
| // NC only: used for assumed-role identity policy resolve via AccountSpaceFS |
There was a problem hiding this comment.
can be removed
aayushchouhan09
left a comment
aayushchouhan09
left a comment
There was a problem hiding this comment.
Can you please check the usage of accountspace in object sdk and sts sdk, if it is not relevant then we can remove it.
f9a7513 to
7ab5e3b
Compare
Signed-off-by: Sakshi Munjal <sakshimunjal@Sakshis-MacBook-Pro.local>
7ab5e3b to
9450530
Compare
| type: { | ||
| // to make consistent with containerized | ||
| type: 'string', | ||
| enum: ['account', 'user', 'role'], |
There was a problem hiding this comment.
@aayushchouhan09 in you PR can you define it in common_api so it can be reused here and in your changes?
5 participants
Describe the Problem
NC lacked standalone IAM role support: role CRUD was NotImplemented, and STS/S3 assumed-role flows only worked via containerized system_store.
Explain the Changes
Issues: Fixed #xxx / Gap #xxx
Testing Instructions:
Summary by CodeRabbit