From: Casey Bodley <cbodley@redhat.com>
Date: Thu, 14 Mar 2024 19:23:12 +0000 (-0400)
Subject: rgw/pubsub: CreateTopic consults identity policies when topic doesn't exist
X-Git-Tag: testing/wip-pdonnell-testing-20240416.232051-debug~25^2~16
X-Git-Url: http://git.apps.os.sepia.ceph.com/?a=commitdiff_plain;h=8896b227226fad92d280e72cd08210685dd445af;p=ceph-ci.git

rgw/pubsub: CreateTopic consults identity policies when topic doesn't exist

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---

diff --git a/src/rgw/rgw_rest_pubsub.cc b/src/rgw/rgw_rest_pubsub.cc
index e268a4fadba..891b015a7f4 100644
--- a/src/rgw/rgw_rest_pubsub.cc
+++ b/src/rgw/rgw_rest_pubsub.cc
@@ -329,9 +329,20 @@ class RGWPSCreateTopicOp : public RGWOp {
       return 0;
     }
 
-    if (topic && !verify_topic_permission(this, s, *topic, topic_arn,
-                                          rgw::IAM::snsCreateTopic)) {
-      return -ERR_AUTHORIZATION;
+    if (topic) {
+      // consult topic policy for overwrite permission
+      if (!verify_topic_permission(this, s, *topic, topic_arn,
+                                   rgw::IAM::snsCreateTopic)) {
+        return -ERR_AUTHORIZATION;
+      }
+    } else {
+      // if no topic policy exists, just check identity policies for denies
+      constexpr bool mandatory_policy = false;
+      if (!verify_user_permission(this, s, topic_arn,
+                                  rgw::IAM::snsCreateTopic,
+                                  mandatory_policy)) {
+        return -ERR_AUTHORIZATION;
+      }
     }
     return 0;
   }