feat: add consolereadonly canned policy#233
Merged
kannappanr merged 2 commits intominio:mainfrom Apr 22, 2026
Merged
Conversation
Adds a new built-in policy 'consolereadonly' that mirrors 'readonly' but additionally grants s3:ListBucket so users can browse bucket contents (e.g. via the console) without gaining write access. Also adds tests covering both the existing readonly shape and the new consolereadonly policy, including a regression guard that readonly does not allow s3:ListBucket.
allanrogerr
requested review from
harshavardhana,
kannappanr,
klauspost,
krisis and
poornas
kannappanr
approved these changes
Apr 21, 2026
There was a problem hiding this comment.
Pull request overview
Adds a new built-in canned policy consolereadonly alongside existing canned policies in the policy package, with accompanying tests to ensure the canned policy definitions remain valid and stable.
Changes:
- Add a new default canned policy
consolereadonlythat extendsreadonlywiths3:ListBucket. - Add unit tests that assert the exact Allow/Deny action sets for
readonlyandconsolereadonly. - Add a regression-style test ensuring
consolereadonlyallowss3:ListBucketwhilereadonlydoes not.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
policy/constants.go |
Introduces the new consolereadonly entry in DefaultPolicies. |
policy/constants_test.go |
Adds tests validating the contents and behavior of readonly and consolereadonly. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…uard
Without the ok check, if the readonly default policy were ever removed
or renamed, findDefaultPolicy returns a zero Policy{} whose IsAllowed
always returns false, making the regression guard vacuously pass.
Fail fast instead so the assertion cannot silently rot.
poornas
approved these changes
Apr 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Needed for https://github.com/miniohq/eos/pull/4414
Summary
Adds a new built-in canned policy
consolereadonlythat mirrors the existingreadonlypolicy but additionally grantss3:ListBucket, so users can browse bucket contents (e.g. from the console) without gaining write access.Motivation
The built-in
readonlypolicy grants onlys3:GetBucketLocationands3:GetObject. A user bound toreadonlycanGETa known object key but cannot list objects in a bucket or enumerate buckets via the console, which makes it unsuitable for the common "let this user browse but not write" use case. Granting write-capable policies to work around this is overly permissive.consolereadonlyfills that gap without touching the semantics of the existingreadonlypolicy.How to test
New tests:
TestDefaultPolicyReadOnly— invariant check for existingreadonlyTestDefaultPolicyConsoleReadOnly— new policy has the expected Allow/Deny action setTestDefaultPolicyConsoleReadOnlyAllowsListBucket— asserts the new policy allowss3:ListBucketand thatreadonlydoes not (regression guard)Types of changes
Checklist