wip

lib/auth/v4/validateInputs.ts

@@ -44,8 +44,8 @@ export function validateCredentials(
         return errors.RequestTimeTooSkewed;
     }
     if (service !== 's3' && service !== 'iam' && service !== 'ring' &&
-        service !== 'sts') {
+        service !== 'sts' && service !== 'scality') {
-        log.warn('service in credentials is not one of s3/iam/ring/sts', {
+        log.warn('service in credentials is not one of s3/iam/ring/sts/scality', {
             service,
         });
         return errors.InvalidArgument;

lib/policyEvaluator/RequestContext.ts

@@ -11,6 +11,7 @@ import {
     actionMapIAM,
     actionMapSSO,
     actionMapSTS,
+    actionMapScality,
     actionMapMetadata,
 } from './utils/actionMaps';
 
@@ -36,6 +37,8 @@ function _findAction(service: string, method: string) {
             return actionMapSTS[method];
         case 'metadata':
             return actionMapMetadata[method];
+        case 'scality':
+            return actionMapScality[method];
         default:
             return undefined;
     }
@@ -49,6 +52,9 @@ function _buildArn(
 ) {
     // arn:partition:service:region:account-id:resourcetype/resource
     switch (service) {
+        case 'scality': {
+            return `arn:aws:iam::${requesterInfo!.accountid}:/${generalResource}/`;
+        }
         case 's3': {
             // arn:aws:s3:::bucket/object
             // General resource is bucketName

lib/policyEvaluator/utils/actionMaps.ts

@@ -199,6 +199,14 @@ const actionMapIAM = {
     listUserTags: 'iam:ListUserTags',
 };
 
+const actionMapScality = {
+    updateAccountAttributes: 'scality:UpdateAccountAttributes',
+    UpdateAccountQuota: 'scality:UpdateAccountQuota',
+    DeleteAccountQuota: 'scality:DeleteAccountQuota',
+    DeleteAccount: 'scality:DeleteAccount',
+    GenerateAccountAccessKey: 'scality:GenerateAccountAccessKey',
+};
+
 const actionMapSSO = {
     SsoAuthorize: 'sso:Authorize',
 };
@@ -221,4 +229,5 @@ export {
     actionMapSSO,
     actionMapSTS,
     actionMapMetadata,
+    actionMapScality,
 };