Skip to content

feat(policy): add s3tables table annotation actions #259

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
harshavardhana merged 2 commits into from
Aug 17, 2026
Merged

feat(policy): add s3tables table annotation actions #259

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
002ad6d
feat(policy): add s3tables table annotation actions
harshavardhana Aug 17, 2026
d777126
docs(policy): call non-AWS actions AIStor extensions
harshavardhana Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ Packages are scoped by capability at the repo root (for example `policy`, `ldap`
Run these commands before opening a pull request; they mirror the CI stack.

## Coding Style & Naming Conventions
Call a non-AWS action, API, or behavior an **AIStor extension**, never a "MinIO extension" — the product is MinIO AIStor, and what these comments distinguish is what AWS defines from what AIStor adds.

Always format Go sources with `gofmt`/`goimports`. Follow the CLAUDE guidance from `miniohq/eos`: keep comments minimal, explaining **why** the code exists, never **what**, and do not leave “removed because” notes when deleting code. Use descriptive package names that mirror directory names and exported identifiers with GoDoc-ready sentences. Stick to tab-indented Go style and avoid introducing logging or HTTP helpers that bypass established patterns in sibling MinIO repos without prior discussion.

## Testing Guidelines
Expand Down
6 changes: 3 additions & 3 deletions policy/action.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,11 +87,11 @@ const (
ListBucketMultipartUploadsAction Action = "s3:ListBucketMultipartUploads"

// ListenNotificationAction - ListenNotification Rest API action.
// This is MinIO extension.
// This is an AIStor extension.
ListenNotificationAction Action = "s3:ListenNotification"

// ListenBucketNotificationAction - ListenBucketNotification Rest API action.
// This is MinIO extension.
// This is an AIStor extension.
ListenBucketNotificationAction Action = "s3:ListenBucketNotification"

// ListMultipartUploadPartsAction - ListParts Rest API action.
Expand Down Expand Up @@ -226,7 +226,7 @@ const (

// RestoreObjectAction - RestoreObject REST API action
RestoreObjectAction Action = "s3:RestoreObject"
// ResetBucketReplicationStateAction - MinIO extension API ResetBucketReplicationState to reset replication state
// ResetBucketReplicationStateAction - AIStor extension API ResetBucketReplicationState to reset replication state
Comment thread
harshavardhana marked this conversation as resolved.
// on a bucket
ResetBucketReplicationStateAction Action = "s3:ResetBucketReplicationState"

Expand Down
8 changes: 8 additions & 0 deletions policy/constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -318,6 +318,11 @@ var DefaultPolicies = []struct {
Action(S3TablesRenameFunctionAction),
Action(S3TablesDeleteFunctionAction),
Action(S3TablesRegisterFunctionAction),
// Table annotations
Action(S3TablesPutTableAnnotationAction),
Action(S3TablesGetTableAnnotationAction),
Action(S3TablesListTableAnnotationsAction),
Action(S3TablesDeleteTableAnnotationAction),
// Catalog config + metrics
Action(S3TablesGetConfigAction),
Action(S3TablesTableMetricsAction),
Expand Down Expand Up @@ -364,6 +369,9 @@ var DefaultPolicies = []struct {
// Function read
Action(S3TablesGetFunctionAction),
Action(S3TablesListFunctionsAction),
// Table annotation read
Action(S3TablesGetTableAnnotationAction),
Action(S3TablesListTableAnnotationsAction),
// Catalog config + metrics
Action(S3TablesGetConfigAction),
Action(S3TablesTableMetricsAction),
Expand Down
95 changes: 58 additions & 37 deletions policy/table-action.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ const (
// S3TablesDeleteTableAction maps to the AWS `DeleteTable` S3 Tables action.
S3TablesDeleteTableAction TableAction = "s3tables:DeleteTable"

// S3TablesDeleteTableEncryptionAction is a MinIO extension for deleting a
// S3TablesDeleteTableEncryptionAction is an AIStor extension for deleting a
// table-level encryption configuration override.
S3TablesDeleteTableEncryptionAction TableAction = "s3tables:DeleteTableEncryption"

Expand Down Expand Up @@ -95,158 +95,171 @@ const (
// S3TablesUpdateTableMetadataLocationAction maps to the AWS `UpdateTableMetadataLocation` S3 Tables action.
S3TablesUpdateTableMetadataLocationAction TableAction = "s3tables:UpdateTableMetadataLocation"

// S3TablesCreateWarehouseAction is a MinIO extension for Iceberg warehouse provisioning.
// S3TablesCreateWarehouseAction is an AIStor extension for Iceberg warehouse provisioning.
S3TablesCreateWarehouseAction TableAction = "s3tables:CreateWarehouse"

// S3TablesCreateTableBucketAction maps to the AWS `CreateTableBucket` S3 Tables action.
// Prefer using S3TablesCreateWarehouseAction instead.
S3TablesCreateTableBucketAction TableAction = "s3tables:CreateTableBucket"

// S3TablesDeleteWarehouseAction is a MinIO extension for deleting Iceberg warehouses.
// S3TablesDeleteWarehouseAction is an AIStor extension for deleting Iceberg warehouses.
S3TablesDeleteWarehouseAction TableAction = "s3tables:DeleteWarehouse"

// S3TablesDeleteTableBucketAction maps to the AWS `DeleteTableBucket` S3 Tables action.
// Prefer using S3TablesDeleteWarehouseAction instead.
S3TablesDeleteTableBucketAction TableAction = "s3tables:DeleteTableBucket"

// S3TablesDeleteWarehouseEncryptionAction is a MinIO extension for deleting warehouse encryption configuration.
// S3TablesDeleteWarehouseEncryptionAction is an AIStor extension for deleting warehouse encryption configuration.
S3TablesDeleteWarehouseEncryptionAction TableAction = "s3tables:DeleteWarehouseEncryption"

// S3TablesDeleteTableBucketEncryptionAction maps to the AWS `DeleteTableBucketEncryption` S3 Tables action.
// Prefer using S3TablesDeleteWarehouseEncryptionAction instead.
S3TablesDeleteTableBucketEncryptionAction TableAction = "s3tables:DeleteTableBucketEncryption"

// S3TablesDeleteWarehousePolicyAction is a MinIO extension for deleting warehouse policies.
// S3TablesDeleteWarehousePolicyAction is an AIStor extension for deleting warehouse policies.
S3TablesDeleteWarehousePolicyAction TableAction = "s3tables:DeleteWarehousePolicy"

// S3TablesDeleteTableBucketPolicyAction maps to the AWS `DeleteTableBucketPolicy` S3 Tables action.
// Prefer using S3TablesDeleteWarehousePolicyAction instead.
S3TablesDeleteTableBucketPolicyAction TableAction = "s3tables:DeleteTableBucketPolicy"

// S3TablesGetWarehouseAction is a MinIO extension for retrieving warehouse details.
// S3TablesGetWarehouseAction is an AIStor extension for retrieving warehouse details.
S3TablesGetWarehouseAction TableAction = "s3tables:GetWarehouse"

// S3TablesGetTableBucketAction maps to the AWS `GetTableBucket` S3 Tables action.
// Prefer using S3TablesGetWarehouseAction instead.
S3TablesGetTableBucketAction TableAction = "s3tables:GetTableBucket"

// S3TablesGetWarehouseEncryptionAction is a MinIO extension for retrieving warehouse encryption configuration.
// S3TablesGetWarehouseEncryptionAction is an AIStor extension for retrieving warehouse encryption configuration.
S3TablesGetWarehouseEncryptionAction TableAction = "s3tables:GetWarehouseEncryption"

// S3TablesGetTableBucketEncryptionAction maps to the AWS `GetTableBucketEncryption` S3 Tables action.
// Prefer using S3TablesGetWarehouseEncryptionAction instead.
S3TablesGetTableBucketEncryptionAction TableAction = "s3tables:GetTableBucketEncryption"

// S3TablesGetWarehouseMaintenanceConfigurationAction is a MinIO extension for retrieving warehouse maintenance configuration.
// S3TablesGetWarehouseMaintenanceConfigurationAction is an AIStor extension for retrieving warehouse maintenance configuration.
S3TablesGetWarehouseMaintenanceConfigurationAction TableAction = "s3tables:GetWarehouseMaintenanceConfiguration"

// S3TablesGetTableBucketMaintenanceConfigurationAction maps to the AWS `GetTableBucketMaintenanceConfiguration` S3 Tables action.
// Prefer using S3TablesGetWarehouseMaintenanceConfigurationAction instead.
S3TablesGetTableBucketMaintenanceConfigurationAction TableAction = "s3tables:GetTableBucketMaintenanceConfiguration"

// S3TablesGetWarehousePolicyAction is a MinIO extension for retrieving warehouse policies.
// S3TablesGetWarehousePolicyAction is an AIStor extension for retrieving warehouse policies.
S3TablesGetWarehousePolicyAction TableAction = "s3tables:GetWarehousePolicy"

// S3TablesGetTableBucketPolicyAction maps to the AWS `GetTableBucketPolicy` S3 Tables action.
// Prefer using S3TablesGetWarehousePolicyAction instead.
S3TablesGetTableBucketPolicyAction TableAction = "s3tables:GetTableBucketPolicy"

// S3TablesListWarehousesAction is a MinIO extension for listing Iceberg warehouses.
// S3TablesListWarehousesAction is an AIStor extension for listing Iceberg warehouses.
S3TablesListWarehousesAction TableAction = "s3tables:ListWarehouses"

// S3TablesListTableBucketsAction maps to the AWS `ListTableBuckets` S3 Tables action.
// Prefer using S3TablesListWarehousesAction instead.
S3TablesListTableBucketsAction TableAction = "s3tables:ListTableBuckets"

// S3TablesPutWarehouseEncryptionAction is a MinIO extension for setting warehouse encryption configuration.
// S3TablesPutWarehouseEncryptionAction is an AIStor extension for setting warehouse encryption configuration.
S3TablesPutWarehouseEncryptionAction TableAction = "s3tables:PutWarehouseEncryption"

// S3TablesPutTableBucketEncryptionAction maps to the AWS `PutTableBucketEncryption` S3 Tables action.
// Prefer using S3TablesPutWarehouseEncryptionAction instead.
S3TablesPutTableBucketEncryptionAction TableAction = "s3tables:PutTableBucketEncryption"

// S3TablesPutWarehouseMaintenanceConfigurationAction is a MinIO extension for setting warehouse maintenance configuration.
// S3TablesPutWarehouseMaintenanceConfigurationAction is an AIStor extension for setting warehouse maintenance configuration.
S3TablesPutWarehouseMaintenanceConfigurationAction TableAction = "s3tables:PutWarehouseMaintenanceConfiguration"

// S3TablesPutTableBucketMaintenanceConfigurationAction maps to the AWS `PutTableBucketMaintenanceConfiguration` S3 Tables action.
// Prefer using S3TablesPutWarehouseMaintenanceConfigurationAction instead.
S3TablesPutTableBucketMaintenanceConfigurationAction TableAction = "s3tables:PutTableBucketMaintenanceConfiguration"

// S3TablesPutWarehousePolicyAction is a MinIO extension for setting warehouse policies.
// S3TablesPutWarehousePolicyAction is an AIStor extension for setting warehouse policies.
S3TablesPutWarehousePolicyAction TableAction = "s3tables:PutWarehousePolicy"

// S3TablesPutTableBucketPolicyAction maps to the AWS `PutTableBucketPolicy` S3 Tables action.
// Prefer using S3TablesPutWarehousePolicyAction instead.
S3TablesPutTableBucketPolicyAction TableAction = "s3tables:PutTableBucketPolicy"

// S3TablesGetConfigAction is a MinIO extension for retrieving catalog configuration.
// S3TablesGetConfigAction is an AIStor extension for retrieving catalog configuration.
S3TablesGetConfigAction TableAction = "s3tables:GetConfig"

// S3TablesTableMetricsAction is a MinIO extension exposing table metrics.
// S3TablesTableMetricsAction is an AIStor extension exposing table metrics.
S3TablesTableMetricsAction TableAction = "s3tables:TableMetrics"

// S3TablesUpdateTableAction is a MinIO extension for Iceberg-compatible table updates.
// S3TablesUpdateTableAction is an AIStor extension for Iceberg-compatible table updates.
S3TablesUpdateTableAction TableAction = "s3tables:UpdateTable"

// S3TablesCreateViewAction is a MinIO extension for creating Iceberg views.
// S3TablesCreateViewAction is an AIStor extension for creating Iceberg views.
S3TablesCreateViewAction TableAction = "s3tables:CreateView"

// S3TablesDeleteViewAction is a MinIO extension for deleting Iceberg views.
// S3TablesDeleteViewAction is an AIStor extension for deleting Iceberg views.
S3TablesDeleteViewAction TableAction = "s3tables:DeleteView"

// S3TablesGetViewAction is a MinIO extension for retrieving Iceberg views.
// S3TablesGetViewAction is an AIStor extension for retrieving Iceberg views.
S3TablesGetViewAction TableAction = "s3tables:GetView"

// S3TablesRenameViewAction is a MinIO extension for renaming Iceberg views.
// S3TablesRenameViewAction is an AIStor extension for renaming Iceberg views.
S3TablesRenameViewAction TableAction = "s3tables:RenameView"

// S3TablesUpdateViewAction is a MinIO extension for updating Iceberg views.
// S3TablesUpdateViewAction is an AIStor extension for updating Iceberg views.
S3TablesUpdateViewAction TableAction = "s3tables:UpdateView"

// S3TablesListViewsAction is a MinIO extension for listing Iceberg views.
// S3TablesListViewsAction is an AIStor extension for listing Iceberg views.
S3TablesListViewsAction TableAction = "s3tables:ListViews"

// S3TablesRegisterViewAction is a MinIO extension for registering Iceberg views.
// S3TablesRegisterViewAction is an AIStor extension for registering Iceberg views.
S3TablesRegisterViewAction TableAction = "s3tables:RegisterView"

// S3TablesCreateFunctionAction is a MinIO extension for creating Iceberg functions (SQL UDFs).
// S3TablesCreateFunctionAction is an AIStor extension for creating Iceberg functions (SQL UDFs).
S3TablesCreateFunctionAction TableAction = "s3tables:CreateFunction"

// S3TablesDeleteFunctionAction is a MinIO extension for deleting Iceberg functions (SQL UDFs).
// S3TablesDeleteFunctionAction is an AIStor extension for deleting Iceberg functions (SQL UDFs).
S3TablesDeleteFunctionAction TableAction = "s3tables:DeleteFunction"

// S3TablesGetFunctionAction is a MinIO extension for retrieving Iceberg functions (SQL UDFs).
// S3TablesGetFunctionAction is an AIStor extension for retrieving Iceberg functions (SQL UDFs).
S3TablesGetFunctionAction TableAction = "s3tables:GetFunction"

// S3TablesRenameFunctionAction is a MinIO extension for renaming Iceberg functions (SQL UDFs).
// S3TablesRenameFunctionAction is an AIStor extension for renaming Iceberg functions (SQL UDFs).
S3TablesRenameFunctionAction TableAction = "s3tables:RenameFunction"

// S3TablesUpdateFunctionAction is a MinIO extension for updating Iceberg functions (SQL UDFs).
// S3TablesUpdateFunctionAction is an AIStor extension for updating Iceberg functions (SQL UDFs).
S3TablesUpdateFunctionAction TableAction = "s3tables:UpdateFunction"

// S3TablesListFunctionsAction is a MinIO extension for listing Iceberg functions (SQL UDFs).
// S3TablesListFunctionsAction is an AIStor extension for listing Iceberg functions (SQL UDFs).
S3TablesListFunctionsAction TableAction = "s3tables:ListFunctions"

// S3TablesRegisterFunctionAction is a MinIO extension for registering Iceberg functions (SQL UDFs).
// S3TablesRegisterFunctionAction is an AIStor extension for registering Iceberg functions (SQL UDFs).
S3TablesRegisterFunctionAction TableAction = "s3tables:RegisterFunction"

// S3TablesUpdateNamespacePropertiesAction is a MinIO extension for updating namespace properties.
// S3TablesUpdateNamespacePropertiesAction is an AIStor extension for updating namespace properties.
S3TablesUpdateNamespacePropertiesAction TableAction = "s3tables:UpdateNamespaceProperties"

// S3TablesTagWarehouseAction is a MinIO extension for tagging Iceberg warehouses.
// S3TablesTagWarehouseAction is an AIStor extension for tagging Iceberg warehouses.
S3TablesTagWarehouseAction TableAction = "s3tables:TagWarehouse"
// S3TablesUntagWarehouseAction is a MinIO extension for removing tags from Iceberg warehouses.
// S3TablesUntagWarehouseAction is an AIStor extension for removing tags from Iceberg warehouses.
S3TablesUntagWarehouseAction TableAction = "s3tables:UntagWarehouse"
// S3TablesListTagsForWarehouseAction is a MinIO extension for listing tags on Iceberg warehouses.
// S3TablesListTagsForWarehouseAction is an AIStor extension for listing tags on Iceberg warehouses.
S3TablesListTagsForWarehouseAction TableAction = "s3tables:ListTagsForWarehouse"

// S3TablesTagTableAction is a MinIO extension for tagging tables.
// S3TablesTagTableAction is an AIStor extension for tagging tables.
S3TablesTagTableAction TableAction = "s3tables:TagTable"
// S3TablesUntagTableAction is a MinIO extension for removing tags from tables.
// S3TablesUntagTableAction is an AIStor extension for removing tags from tables.
S3TablesUntagTableAction TableAction = "s3tables:UntagTable"
// S3TablesListTagsForTableAction is a MinIO extension for listing tags on tables.
// S3TablesListTagsForTableAction is an AIStor extension for listing tags on tables.
S3TablesListTagsForTableAction TableAction = "s3tables:ListTagsForTable"

// S3TablesPutTableAnnotationAction is an AIStor extension for attaching a
// named annotation payload to a table.
S3TablesPutTableAnnotationAction TableAction = "s3tables:PutTableAnnotation"
// S3TablesGetTableAnnotationAction is an AIStor extension for reading one of a
// table's annotations.
S3TablesGetTableAnnotationAction TableAction = "s3tables:GetTableAnnotation"
// S3TablesListTableAnnotationsAction is an AIStor extension for listing a
// table's annotations.
S3TablesListTableAnnotationsAction TableAction = "s3tables:ListTableAnnotations"
// S3TablesDeleteTableAnnotationAction is an AIStor extension for removing one
// of a table's annotations.
S3TablesDeleteTableAnnotationAction TableAction = "s3tables:DeleteTableAnnotation"

// AllS3TablesActions - all Amazon S3 Tables actions
AllS3TablesActions TableAction = "s3tables:*"
)
Expand Down Expand Up @@ -324,6 +337,10 @@ var SupportedTableActions = map[TableAction]struct{}{
S3TablesTagTableAction: {},
S3TablesUntagTableAction: {},
S3TablesListTagsForTableAction: {},
S3TablesPutTableAnnotationAction: {},
S3TablesGetTableAnnotationAction: {},
S3TablesListTableAnnotationsAction: {},
S3TablesDeleteTableAnnotationAction: {},
AllS3TablesActions: {},
}

Expand Down Expand Up @@ -469,6 +486,10 @@ func createTableActionConditionKeyMap() map[Action]condition.KeySet {
tableActionConditionKeyMap[Action(S3TablesTagTableAction)] = withTableCommon()
tableActionConditionKeyMap[Action(S3TablesUntagTableAction)] = withTableCommon()
tableActionConditionKeyMap[Action(S3TablesListTagsForTableAction)] = withTableCommon()
tableActionConditionKeyMap[Action(S3TablesPutTableAnnotationAction)] = withTableCommon()
tableActionConditionKeyMap[Action(S3TablesGetTableAnnotationAction)] = withTableCommon()
tableActionConditionKeyMap[Action(S3TablesListTableAnnotationsAction)] = withTableCommon()
tableActionConditionKeyMap[Action(S3TablesDeleteTableAnnotationAction)] = withTableCommon()

return tableActionConditionKeyMap
}
Expand Down
Loading