fix(sts): align AssumeRole authorization (#5281)

* fix(sts): align AssumeRole authorization with MinIO * test(sts): cover AssumeRole OPA contract * fix(iam): fail closed on unresolved policies * fix(iam): fail closed while OPA initializes --------- Co-authored-by: cxymds <[email protected]> Co-authored-by: Zhengchao An <[email protected]>
2026-08-01 11:48:58 +08:00
parent 2b31bda6d1
commit 3d4f4bb86d
7 changed files with 733 additions and 136 deletions
@@ -183,7 +183,7 @@ async fn handle_assume_role(
            conditions: &conditions,
            is_owner: owner,
            claims: cred.claims_or_empty(),
-            deny_only: false,
+            deny_only: true,
            bucket: "",
            object: "",
        })