]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph.git/commit
rgw/sns: ListTopics uses account root arn for policy evaluation 68429/head
authorCasey Bodley <cbodley@redhat.com>
Thu, 16 Apr 2026 16:49:43 +0000 (12:49 -0400)
committerCasey Bodley <cbodley@redhat.com>
Thu, 16 Apr 2026 18:14:21 +0000 (14:14 -0400)
commitb81bc9531732a8a4b9dec00fb72dbfeb6f00f98f
tree575f4219eb20835ee2d84785ed52cb4bfde713d1
parentccdbebd925b77eb7c5d0ba9a3a175642babcf291
rgw/sns: ListTopics uses account root arn for policy evaluation

when called by a non-root account user, permissions from identity policy
were not being applied correctly and always resulted in:
> evaluate_iam_policies: implicit deny from identity-based policy

passing a non-empty ARN argument to verify_user_permission() fixes this.
while other SNS APIs use a specific topic's arn, ListTopics doesn't
operate on individual topics so we use the account root user's arn

Fixes: https://tracker.ceph.com/issues/74595
Signed-off-by: Casey Bodley <cbodley@redhat.com>
src/rgw/rgw_rest_pubsub.cc