gravitational/teleport
1
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-10-11 22:49:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

accessmonitoring: Evaluate constrained resources in access requests (#287)

Browse Source 
Export-Source-Commit: b083e8bc1397c4ba87200ee8b24eef61860f3a1c
This commit is contained in:
Cam Hutchison
2026-08-25 11:35:10 -05:00
committed by Gus Rivera
parent 85d6c8bc79
commit a5b95e952c
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/access/accessmonitoring/access_monitoring_rules.go
+8 -1
View File
@@ -266,10 +266,17 @@ func (amrh *RuleHandler) newExpressionEnv(ctx context.Context, req types.AccessR
req.UsePreviewAsRoles = true
}
// GetAllRequestedResourceIDs() returns []ResourceAccessID.
// RiskyExtractResourceIDs() maps []ResourceAccessID to []ResourceID,
// removing constrains associated with resourceIDs. This is not risky
// in this context as we just need the resource IDs for getting the
// resource labels for the access monitoring rule condition expression
// evaluation.
resourceIDs := types.RiskyExtractResourceIDs(req.GetAllRequestedResourceIDs())
requestedResources, err := accessrequest.GetResourcesByResourceIDs(
ctx,
amrh.apiClient,
req.GetRequestedResourceIDs(),
resourceIDs,
usePreviewAsRoles,
)
if err != nil {
lib/accessmonitoring/review/review.go
+9 -1
View File
@@ -293,7 +293,15 @@ func (handler *Handler) newExpressionEnv(ctx context.Context, req types.AccessRe
return accessmonitoring.AccessRequestExpressionEnv{}, trace.Wrap(err)
}
requestedResources, err := accessrequest.GetResourcesByResourceIDs(ctx, handler.Client, req.GetRequestedResourceIDs())
// GetAllRequestedResourceIDs includes resources that carry
// constraints; RiskyExtractResourceIDs then drops those constraints,
// keeping only the bare IDs to fetch. Dropping them is safe here:
// access monitoring expressions have no access to constraints, and
// because a constraint only narrows the request, evaluating the
// un-narrowed resource means a restrictive (DENY) expression cannot be
// circumvented by adding a constraint.
resourceIDs := types.RiskyExtractResourceIDs(req.GetAllRequestedResourceIDs())
requestedResources, err := accessrequest.GetResourcesByResourceIDs(ctx, handler.Client, resourceIDs)
if err != nil {
return accessmonitoring.AccessRequestExpressionEnv{}, trace.Wrap(err)
}