IAM Roles | Store roles in accounts with type=role instead of a separate iam_roles collection

src/api/account_api.js

@@ -1543,10 +1543,10 @@ module.exports = {
                 nsfs_account_config: {
                     $ref: 'common_api#/definitions/nsfs_account_config'
                 },
-                iam_user_policies: {
+                iam_inline_policies: {
                     type: 'array',
                     items: {
-                        $ref: 'common_api#/definitions/iam_user_policy',
+                        $ref: 'common_api#/definitions/iam_inline_policy',
                     }
                 },
                 owner: {
@@ -1644,10 +1644,10 @@ module.exports = {
                 owner_access_key: {
                     $ref: 'common_api#/definitions/access_key'
                 },
-                iam_role_policies: {
+                iam_inline_policies: {
                     type: 'array',
                     items: {
-                        $ref: 'common_api#/definitions/iam_user_policy',
+                        $ref: 'common_api#/definitions/iam_inline_policy',
                     }
                 }
             }

src/api/common_api.js

@@ -117,6 +117,11 @@ module.exports = {
             enum: ['DISABLED', 'SUSPENDED', 'ENABLED']
         },
 
+        identity_type: {
+            type: 'string',
+            enum: ['ACCOUNT', 'USER', 'ROLE']
+        },
+
         assume_role_policy: {
             type: 'object',
             required: ['statement'],
@@ -586,7 +591,7 @@ module.exports = {
             }
         },
 
-        iam_user_policy: {
+        iam_inline_policy: {
             type: 'object',
             required: ['policy_name', 'policy_document'],
             properties: {
@@ -596,7 +601,10 @@ module.exports = {
                 }
             }
         },
-
+        // TODO: NC compatibility alias, remove after NC migrates to iam_inline_policy
+        iam_user_policy: {
+            $ref: '#/definitions/iam_inline_policy',
+        },
         // IAM role trust policy (who can assume this role)
         iam_trust_policy_principal: {
             allOf: [{

src/endpoint/iam/iam_utils.js

@@ -1360,11 +1360,11 @@ function _get_assumed_role_session_info(req) {
  */
 async function _get_identity_policies(account, is_iam_user, assumed_role_arn, bucketspace) {
     if (is_iam_user) {
-        return account.iam_user_policies || [];
+        return account.iam_inline_policies || [];
     }
     const resolved_role = await resolve_iam_role_by_arn(assumed_role_arn, bucketspace);
     if (!resolved_role?.iam_role) return null;
-    return resolved_role.iam_role.iam_role_policies || [];
+    return resolved_role.iam_role.iam_inline_policies || [];
 }
 
 /**

src/sdk/nb.d.ts

@@ -71,6 +71,7 @@ type ID = mongodb.ObjectID;
 type DBBuffer = mongodb.Binary | Buffer;
 
 type LockType = "EXCLUSIVE" | "SHARED" | undefined;
+type IdentityType = 'ACCOUNT' | 'USER' | 'ROLE';
 
 interface System extends Base {
     _id: ID;
@@ -92,25 +93,28 @@ interface Account extends Base {
     email: SensitiveString;
     next_password_change: Date;
     is_support?: boolean;
+    identity_type?: IdentityType;
     access_keys: Array<{
         access_key: SensitiveString;
         secret_key: SensitiveString;
     }>;
     master_key_id: ID;
+    iam_path?: string;
+    iam_inline_policies?: object[];
+    description?: string;
+    max_session_duration?: number;
+    assume_role_policy_document?: object;
+    creation_date?: Date;
+    deleted?: Date;
 }
 
-interface IamRole extends Base {
-    _id: ID;
+/** IAM role identity stored in accounts with identity_type === 'ROLE' */
+type IamRole = Account & {
+    identity_type: 'ROLE';
     owner: ID;
-    name: string;
-    iam_path: string;
-    description?: string;
-    max_session_duration?: number;
     assume_role_policy_document: object;
-    iam_role_policies?: object[];
     creation_date: Date;
-    deleted?: Date;
-}
+};
 
 interface NodeAPI extends Base {
     _id: ID;

src/sdk/object_sdk.js

@@ -69,6 +69,7 @@ const account_cache = new LRUCache({
 const iam_roles_cache = new LRUCache({
     name: 'IamRolesCache',
     expiry_ms: config.IAM_ROLES_CACHE_EXPIRY_MS,
+    max_usage: 1000,
     /**
      * Set type for the generic template
      * @param {{
@@ -77,7 +78,7 @@ const iam_roles_cache = new LRUCache({
      *      bucketspace: nb.BucketSpace;
      * }} params
      */
-    make_key: ({ role_name, owner_account_id }) => `${owner_account_id}:${role_name}`,
+    make_key: ({ role_name, owner_account_id }) => `${owner_account_id}:${role_name.toLowerCase()}`,
     load: async ({ bucketspace, role_name, owner_account_id }) =>
         bucketspace.read_role_by_name({ role_name, owner_account_id }),
 });