Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Policy variables in Resource and NotResource are not expanded

Abierto
  • ¿Algo no está bien?
#533 0 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 2 días

@LeeroyHannigan ya está trabajando en esto.

Desde el 24/10/2026.

  • #535 de @LeeroyHannigan — abierto

Evaluación

Este issue todavía no se ha evaluado.

Descripción

A policy variable in a statement's Resource or NotResource is never expanded. resource_matches in crates/auth/src/policy/evaluator.rs passes each pattern to arn_match as written, so arn:aws:dynamodb:us-east-1:123456789012:table/${aws:PrincipalTag/team} is compared as literal text and matches no table. expand_policy_variables in condition.rs expands variables in condition values only.

On every operation, a Deny written on a variable resource denies nothing, and an Allow written that way grants nothing. With Allow dynamodb:* on * and Deny dynamodb:GetItem on table/${aws:PrincipalTag/team}, a caller tagged team=blue can read table blue.

IAM's rule, measured with aws iam simulate-custom-policy on 2026-10-24 (action dynamodb:GetItem, Allow dynamodb:* on * beside the statement under test):

Statement Context Resource IAM
Deny table/${aws:PrincipalTag/team} team=blue table/blue explicitDeny
same team=blue table/red allowed
same no team tag table/blue allowed
Deny table/${aws:PrincipalTag/team}* team=blue table/blue-x explicitDeny
Allow only table/${aws:username} aws:username=alice table/alice allowed
same aws:username=alice table/bob implicitDeny
Deny table/${aws:PrincipalTag/team}, Version 2008-10-17 team=blue table/blue allowed
same, no Version team=blue table/blue allowed
Deny with NotResource table/${aws:PrincipalTag/team} team=blue table/blue allowed
same team=blue table/red explicitDeny
Deny table/${aws:PrincipalTag/team, 'none'} no team tag table/none explicitDeny

IAM expands variables in Resource and NotResource for a 2012-10-17 document and leaves them literal for 2008-10-17 or no Version; a wildcard after a variable still matches; a variable whose key the request does not carry makes the pattern match nothing; and the ${key, 'default'} form expands to its default when the key is absent. expand_policy_variables does not read the default form either, so a condition value written that way has the same gap.

Fix: expand variables in Resource and NotResource patterns for 2012-10-17 documents before arn_match, with an unresolved variable making that pattern match nothing, and read the ${key, 'default'} form in both places. Tests for each row above.

Lenguaje dominante
Rust
Estrellas
517
Forks
60
Merge medio
2 d 23 h
PR fusionados (30 d)
25

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de ExtendDB/extenddb

Todos los issues de ExtendDB/extenddb

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.