Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Policy variables in Resource and NotResource are not expanded

Aperta
  • Qualcosa non va?
#533 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

@LeeroyHannigan ci sta già lavorando.

Dal 24/10/2026.

  • #535 di @LeeroyHannigan — aperta

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

A policy variable in a statement's Resource or NotResource is never expanded. resource_matches in crates/auth/src/policy/evaluator.rs passes each pattern to arn_match as written, so arn:aws:dynamodb:us-east-1:123456789012:table/${aws:PrincipalTag/team} is compared as literal text and matches no table. expand_policy_variables in condition.rs expands variables in condition values only.

On every operation, a Deny written on a variable resource denies nothing, and an Allow written that way grants nothing. With Allow dynamodb:* on * and Deny dynamodb:GetItem on table/${aws:PrincipalTag/team}, a caller tagged team=blue can read table blue.

IAM's rule, measured with aws iam simulate-custom-policy on 2026-10-24 (action dynamodb:GetItem, Allow dynamodb:* on * beside the statement under test):

Statement Context Resource IAM
Deny table/${aws:PrincipalTag/team} team=blue table/blue explicitDeny
same team=blue table/red allowed
same no team tag table/blue allowed
Deny table/${aws:PrincipalTag/team}* team=blue table/blue-x explicitDeny
Allow only table/${aws:username} aws:username=alice table/alice allowed
same aws:username=alice table/bob implicitDeny
Deny table/${aws:PrincipalTag/team}, Version 2008-10-17 team=blue table/blue allowed
same, no Version team=blue table/blue allowed
Deny with NotResource table/${aws:PrincipalTag/team} team=blue table/blue allowed
same team=blue table/red explicitDeny
Deny table/${aws:PrincipalTag/team, 'none'} no team tag table/none explicitDeny

IAM expands variables in Resource and NotResource for a 2012-10-17 document and leaves them literal for 2008-10-17 or no Version; a wildcard after a variable still matches; a variable whose key the request does not carry makes the pattern match nothing; and the ${key, 'default'} form expands to its default when the key is absent. expand_policy_variables does not read the default form either, so a condition value written that way has the same gap.

Fix: expand variables in Resource and NotResource patterns for 2012-10-17 documents before arn_match, with an unresolved variable making that pattern match nothing, and read the ${key, 'default'} form in both places. Tests for each row above.

Lingua principale
Rust
Stelle
517
Fork
60
Merge medio
2g 23h
PR unite (30g)
25

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ExtendDB/extenddb

Tutte le issue di ExtendDB/extenddb

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.