HDDS-15194. [STS] Update IamSessionPolicyResolver to return S3 Actions

[fmorg-git]

Please describe your PR in detail:

• In https://issues.apache.org/jira/browse/HDDS-15137, each S3 api was associated with one or more S3 actions. In order for Ranger authorizer the authorize against those actions, the IamSessionPolicyResolver needs to be updated to return the S3 actions. This PR makes those updates.

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-15194

How was this patch tested?

unit tests, smoke tests

[github-actions]

This PR has been marked as stale due to 21 days of inactivity. Please comment or remove the stale label to keep it open. Otherwise, it will be automatically closed in 7 days.

[fmorg-git]

commenting to remove stale label

[fmorg-git]

hi @ChenSammi - this PR has been rebased and is ready for review. Thanks!

[Copilot]

Pull request overview

Updates IAM session policy resolution so that resolved AssumeRoleRequest.OzoneGrant entries include the concrete S3 action names (without the s3: prefix), enabling Ranger authorization decisions to be made against the same action set mapped in HDDS-15137.

Changes:

• Track and emit per-resource S3 action names alongside ACLs, and group grants by (ACLs, S3 actions) rather than ACLs alone.
• Expand s3:* into the full set of supported concrete S3Action values (removing the ALL_S3 sentinel) and adjust condition filtering accordingly.
• Update/extend unit tests to validate action propagation and the new grouping behavior across resource types and authorizers.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/security/acl/iam/IamSessionPolicyResolver.java	Adds S3-action tracking to resolved grants, updates wildcard handling, and groups grants by both ACLs and actions.
hadoop-ozone/common/src/test/java/org/apache/hadoop/ozone/security/acl/iam/TestIamSessionPolicyResolver.java	Updates expectations to include S3 actions per grant and covers new grouping/s3:* expansion semantics.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.