Trust policy principals are matched by ARN and are not bound to a unique id
维护者通常 2 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 48/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- aws, rust
调研方向
Start with principal_entry_matches in crates/server/src/management/assume_role.rs, then trace where trust policies are saved and how role and user IDs are assigned. Compare the behavior with the IAM trust policy rules described in the issue. Done means a trust policy bound to a principal stops matching a recreated role or user with the same ARN, while the documented account and root principal matches still work.
由索引模型根据 Issue 内容生成。
描述
What ExtendDB does
principal_entry_matches in crates/server/src/management/assume_role.rs compares a trust policy Principal entry against the caller by exact ARN string, with extra matches for a bare account id and the arn:aws:iam::<account>:root form. ExtendDB stores no principal unique id. A role or user that is deleted and recreated with the same name keeps the same ARN, so it matches a trust policy written for the original principal.
What IAM does
The IAM User Guide (the Principal element of a role trust policy) states that IAM converts a role or user ARN in a trust policy to the principal's unique id when the policy is saved, so a principal that is deleted and recreated with the same name no longer matches. Measured across a delete and recreate: GetRole returns a new RoleId and GetUser a new UserId for the recreated principal.
Effect
A trust relationship meant for one incarnation of a role or user is inherited by a later principal that carries the same name. Deleting and recreating a principal does not drop the trust another role extended to the earlier one.
Suggested fix
Bind a trust policy's named principal to the principal's unique id at write time and match on that id, so a recreated same-named principal does not satisfy a trust policy written for the earlier one.
- 主要语言
- Rust
- 星标
- 517
- 派生
- 60
- 平均合并
- 2 天 23 小时
- 30 天内合并 PR
- 25
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
ExtendDB/extenddb 的其他 Issue
-
documentation
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 2 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 2 天内回复
-
[storage.cassandra] accepts unknown keys silently可能已有人在做 @LeeroyHannigan 于 1 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
ExtendDB/extenddb#540 · 已指派 1 人 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 2 天内回复
-
documentation
难度 2/5 1-3 小时 新手友好度 62/100
维护者通常 2 天内回复
查看 ExtendDB/extenddb 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 73/100
haowjy/mars-agents#228 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 68/100
redlib-org/redlib#604 ·
维护者通常 3 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
dividebysandwich/rust-dos#240 ·
维护者通常 1 天内回复
-
A-UI C-Bug S-Needs-Triage
难度 2/5 1-3 小时 新手友好度 75/100
bevyengine/bevy#26330 ·
维护者通常 2 天内回复