Skip to content

Commit 9e3df37

Browse files
author
Anis Eleuch
committed
svc: Assume Access Key creation to be permitted
Adding this policy will make the user not able to create a service account anymore: ``` { "Effect": "Deny", "Action": [ "admin:CreateServiceAccount" ], "Condition": { "NumericGreaterThanIfExists": {"svc:DurationSeconds": "1500"} } }, ``` The reason is that policy.IsAllowedActions() is called with conditions from the user login. Assume svc account creation to be possible for now until we come up with a better fix
1 parent 02a0db1 commit 9e3df37

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

api/user_session.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,8 +139,11 @@ func getSessionResponse(ctx context.Context, session *models.Principal) (*models
139139

140140
defaultActions := policy.IsAllowedActions("", "", conditionValues)
141141

142+
consoleDefaultActions := defaultActions.Clone()
143+
consoleDefaultActions.Add(minioIAMPolicy.Action(minioIAMPolicy.CreateServiceAccountAdminAction))
144+
142145
permissions := map[string]minioIAMPolicy.ActionSet{
143-
ConsoleResourceName: defaultActions,
146+
ConsoleResourceName: consoleDefaultActions,
144147
}
145148
deniedActions := map[string]minioIAMPolicy.ActionSet{}
146149

0 commit comments

Comments
 (0)