rgw/pubsub: CreateTopic consults identity policies when topic doesn't exist

Signed-off-by: Casey Bodley <cbodley@redhat.com>
(cherry picked from commit 8896b227226fad92d280e72cd08210685dd445af)

diff --git a/src/rgw/rgw_rest_pubsub.cc b/src/rgw/rgw_rest_pubsub.cc
index e268a4fadba4ef0d7d4cdec6e56817d65742a9f2..891b015a7f4f825dbb2fa4371bb5a102d32b725d 100644 (file)
--- a/src/rgw/rgw_rest_pubsub.cc
+++ b/src/rgw/rgw_rest_pubsub.cc
@@ -329,9 +329,20 @@ class RGWPSCreateTopicOp : public RGWOp {
       return 0;
     }
 
-    if (topic && !verify_topic_permission(this, s, *topic, topic_arn,
-                                          rgw::IAM::snsCreateTopic)) {
-      return -ERR_AUTHORIZATION;
+    if (topic) {
+      // consult topic policy for overwrite permission
+      if (!verify_topic_permission(this, s, *topic, topic_arn,
+                                   rgw::IAM::snsCreateTopic)) {
+        return -ERR_AUTHORIZATION;
+      }
+    } else {
+      // if no topic policy exists, just check identity policies for denies
+      constexpr bool mandatory_policy = false;
+      if (!verify_user_permission(this, s, topic_arn,
+                                  rgw::IAM::snsCreateTopic,
+                                  mandatory_policy)) {
+        return -ERR_AUTHORIZATION;
+      }
     }
     return 0;
   }