IAM | Bucket policy Principal validation

Author: naveenpaul1

src/server/system_services/bucket_server.js

@@ -11,6 +11,7 @@ const GoogleStorage = require('../../util/google_storage_wrap');
 
 const P = require('../../util/promise');
 const dbg = require('../../util/debug_module')(__filename);
+const SensitiveString = require('../../util/sensitive_string');
 const config = require('../../../config');
 const MDStore = require('../object_services/md_store').MDStore;
 const BucketStatsStore = require('../analytic_services/bucket_stats_store').BucketStatsStore;
@@ -512,12 +513,38 @@ async function get_bucket_policy(req) {
     };
 }
 
+/* 
+    validate ARN principle 
+    1. validate basic ARN, like arn prefix `arn:aws:iam::`
+    2. If principal ARN end with `root sufix its a account and get account with id eg : aws:arn:${account_id}:root
+    3. if principle ARN contains `user` its a IAM user and get account with username and id 
+        eg : aws:arn:${account_id}:user/${iam_path}/${use_name}
+        account email = ${iam_user_name}:${account_id}
+*/
+async function principal_validation_handler(principal) {
+    const principal_as_string = principal instanceof SensitiveString ? principal.unwrap() : principal;
+    const arn_prefix = 'arn:aws:iam::';
+    const root_sufix = 'root';
+    const user_sufix = 'user';
+    const arn_parts = principal_as_string.split(':');
+    if (!principal_as_string.startsWith(arn_prefix) || arn_parts.length < 6) {
+        return;
+    }
+    const account_id = arn_parts[4];
+    if (principal_as_string.endsWith(root_sufix)) {
+        return system_store.data.accounts.find(account => account._id.toString() === account_id);
+    } else if (principal_as_string.includes(user_sufix)) {
+        const arn_path_parts = principal_as_string.split('/');
+        const iam_user_name = arn_path_parts[arn_path_parts.length - 1];
+        return system_store.get_account_by_email(new SensitiveString(`${iam_user_name}:${account_id}`));
+    }
+}
 
 async function put_bucket_policy(req) {
     dbg.log0('put_bucket_policy:', req.rpc_params);
     const bucket = find_bucket(req, req.rpc_params.name);
     await bucket_policy_utils.validate_s3_policy(req.rpc_params.policy, bucket.name,
-        principal => system_store.get_account_by_email(principal));
+        principal => principal_validation_handler(principal));
 
     if (
         bucket.public_access_block?.block_public_policy &&