crud operations + assume role

src/cmd/nsfs.js

@@ -265,7 +265,7 @@ async function main(argv = minimist(process.argv.slice(2))) {
                 const sts_bucketspace = nsfs_config_root ?
                     new BucketSpaceFS({ config_root: nsfs_config_root }, endpoint_stats_collector.instance()) :
                     new BucketSpaceSimpleFS({ fs_root });
-                req.sts_sdk = new StsSDK(null, null, sts_bucketspace);
+                req.sts_sdk = new StsSDK(null, null, sts_bucketspace, req.object_sdk.accountspace);
             }
         });
         if (config.ALLOW_HTTP) {

src/endpoint/iam/iam_utils.js

@@ -1363,7 +1363,7 @@ async function _get_identity_policies(account, is_iam_user, assumed_role_arn, bu
         return account.iam_user_policies || [];
     }
     const resolved_role = await resolve_iam_role_by_arn(assumed_role_arn, bucketspace);
-    if (!resolved_role.iam_role) return null;
+    if (!resolved_role?.iam_role) return null;
     return resolved_role.iam_role.iam_role_policies || [];
 }
 
@@ -1398,12 +1398,19 @@ async function authorize_request_iam_policy_impl(req, method, bucket_name, servi
     };
 
     const iam_policies = await _get_identity_policies(
-        account, is_iam_user, assumed_role_arn, req.object_sdk?._get_bucketspace());
+        account,
+        is_iam_user,
+        assumed_role_arn,
+        req.object_sdk?._get_bucketspace(),
+    );
     if (iam_policies === null) {
         dbg.error('authorize_request_iam_policy: failed to resolve IAM role for assumed session token');
         return deny_result;
     }
     if (iam_policies.length === 0) {
+        // TODO: remove NC empty-policy allow when PutRolePolicy (Phase 2) is implemented
+        // NC: IAM user / role inline policies are Phase 2; allow until PutRolePolicy exists
+        if (req.object_sdk.nsfs_config_root && (is_iam_user || is_assumed_role_session)) return true;
         dbg.error('authorize_request_iam_policy:', iam_identity, 'has no inline policies configured');
         return deny_result;
     }

src/manage_nsfs/manage_nsfs_cli_errors.js

@@ -252,6 +252,13 @@ ManageCLIError.AccountDeleteForbiddenHasIAMAccounts = Object.freeze({
     http_code: 403,
 });
 
+ManageCLIError.AccountDeleteForbiddenHasIAMRoles = Object.freeze({
+    code: 'AccountDeleteForbiddenHasIAMRoles',
+    message: 'Cannot delete account that is owner of IAM roles. ' +
+        'You must delete all IAM roles before deleting the account',
+    http_code: 403,
+});
+
 ManageCLIError.AccountCannotCreateRootAccountsRequesterIAMUser = Object.freeze({
     code: 'AccountCannotCreateRootAccounts',
     message: 'Cannot update account to have iam_operate_on_root_account. ' +
@@ -591,6 +598,8 @@ const NSFS_CLI_ERROR_EVENT_MAP = {
     AccountAccessKeyAlreadyExists: NoobaaEvent.ACCOUNT_ALREADY_EXISTS,
     AccountNameAlreadyExists: NoobaaEvent.ACCOUNT_ALREADY_EXISTS,
     AccountDeleteForbiddenHasBuckets: NoobaaEvent.ACCOUNT_DELETE_FORBIDDEN,
+    AccountDeleteForbiddenHasIAMAccounts: NoobaaEvent.ACCOUNT_DELETE_FORBIDDEN,
+    AccountDeleteForbiddenHasIAMRoles: NoobaaEvent.ACCOUNT_DELETE_FORBIDDEN,
     BucketAlreadyExists: NoobaaEvent.BUCKET_ALREADY_EXISTS,
     BucketSetForbiddenBucketOwnerNotExists: NoobaaEvent.BUCKET_OWNER_NOT_EXISTS,
     BucketSetForbiddenBucketOwnerIsIAMAccount: NoobaaEvent.BUCKET_OWNER_IS_IAM_ACCOUNT,

src/manage_nsfs/manage_nsfs_validations.js

@@ -653,6 +653,7 @@ async function validate_account_args(config_fs, data, action, is_flag_iam_operat
  * doesn't have resources related to it
  * 1 - buckets that it owns
  * 2 - accounts that it owns
+ * 3 - IAM roles that it owns (under identities/<account_id>/roles)
  * @param {import('../sdk/config_fs').ConfigFS} config_fs
  * @param {object} data
  */
@@ -661,6 +662,21 @@ async function validate_account_resources_before_deletion(config_fs, data) {
     // If it is root account (not owned by other account) then we check that it doesn't owns IAM accounts
     if (data.owner === undefined) {
         await check_if_root_account_does_not_have_IAM_users(config_fs, data, ACTIONS.DELETE);
+        await validate_account_not_owns_roles(config_fs, data);
+    }
+}
+
+/**
+ * validate_account_not_owns_roles blocks account deletion when
+ * identities/<account_id>/roles contains any role entries.
+ * @param {import('../sdk/config_fs').ConfigFS} config_fs
+ * @param {Object} account_data
+ */
+async function validate_account_not_owns_roles(config_fs, account_data) {
+    const role_names = await config_fs.list_roles_under_account(account_data._id);
+    if (role_names.length > 0) {
+        const detail_msg = `Account ${account_data.name} has IAM roles: ${role_names.join(', ')}`;
+        throw_cli_error(ManageCLIError.AccountDeleteForbiddenHasIAMRoles, detail_msg);
     }
 }
 

src/manage_nsfs/nsfs_schema_utils.js

@@ -47,6 +47,7 @@ const validate_logging = ajv.compile(log_schema);
 
 /**
  * validate_account_schema validates an account object against the NC NSFS account schema
+ * Same schema used for account (root account), IAM user and IAM role
  * @param {object} account
  */
 function validate_account_schema(account) {