Skip to content

Conversation

allanrogerr
Copy link
Contributor

Issue

Console searches for the precise policy s3:DeleteObject when allowing a delete of an object or prefix. If a user specifies the usage of the superset s3:DeleteObject* or s3:Delete*, console will disallow delete, even though this is allowed by api.
Also, action s3:DeleteObjectTagging is not respected.

This PR allows a user attached to a policy defined with s3:Delete* to be able to delete this object and its tags through the Console UI.

How to test

1.- Define infrastructure

mc rb <alias>/bucket-name --force --dangerous
mc mb <alias>/bucket-name

mc cp <file> <alias>/bucket-name/test/hosts

2.- Create a user with restricted privileges using s3:Delete*
e.g.

cat << EOF > bucketpolicy.json
{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Allow",
           "Action": [
               "s3:ListBucket",
               "s3:ListAllMyBuckets",
               "s3:GetBucketVersioning",
               "s3:ListBucketVersions",
               "s3:Get*",
               "s3:Put*",
               "s3:Delete*"
           ],
           "Resource": [
               "arn:aws:s3:::bucket-name",
               "arn:aws:s3:::bucket-name/*"
           ]
       }
   ]
}
EOF

mc admin user rm <alias> test-user
mc admin user add <alias> test-user test-usertest-user
mc alias set test-user <endpoint> test-user test-usertest-user

mc admin policy create <alias> test-policy bucketpolicy.json
mc admin policy detach <alias> test-policy --user test-user
mc admin policy attach <alias> test-policy --user test-user

3.- Login to the UI as test-user and successfully delete the uploaded file

fixes #3217

Allow console to recognize Delete*
@allanrogerr allanrogerr force-pushed the allow-console-delete-wildcard branch from 2b328c8 to a036801 Compare February 19, 2025 14:30
@cesnietor
Copy link
Collaborator

context to consider: #3497 (comment)

@allanrogerr allanrogerr self-assigned this Feb 20, 2025
@allanrogerr allanrogerr marked this pull request as ready for review February 20, 2025 20:28
@allanrogerr allanrogerr added the bug this needs to be fixed label Feb 20, 2025
@bexsoft bexsoft merged commit 9e0416f into master Feb 21, 2025
29 of 30 checks passed
@bexsoft bexsoft deleted the allow-console-delete-wildcard branch February 21, 2025 18:04
@harshavardhana
Copy link
Member

This PR must be also sent for miniohq/aistor

huncrys pushed a commit to huncrys/minio-console that referenced this pull request Jun 8, 2025
georgmangold pushed a commit to georgmangold/console that referenced this pull request Jun 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug this needs to be fixed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Policy action wildcards do not include the policy with no character after wildcard
5 participants