)]}'
{"id":"openstack%2Fkeystone~983587","triplet_id":"openstack%2Fkeystone~master~Ib6904ec9f1bc069a9f607d39814b1d2633c17f53","project":"openstack/keystone","branch":"master","topic":"bug/2142138","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-04-08 17:21:42.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-04-08 17:21:42.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ib6904ec9f1bc069a9f607d39814b1d2633c17f53","subject":"Prevent unauthorized EC2 credential creation and deletion","status":"MERGED","created":"2026-04-07 16:03:23.000000000","updated":"2026-04-08 17:23:07.000000000","submitted":"2026-04-08 17:21:42.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"983587-bug/2142138","meta_rev_id":"a989fffdf53d14caf3adbba460498ea041fe86cb","_number":983587,"virtual_id_number":983587,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-04-08 17:21:41.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"all":[{"value":2,"date":"2026-04-08 15:25:07.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":2,"date":"2026-04-08 10:19:36.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"all":[{"value":1,"date":"2026-04-08 15:25:07.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-04-07 16:03:23.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-04-07 16:25:28.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2026-04-07 17:29:39.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-04-08 15:25:07.000000000","updated_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"}],"messages":[{"id":"8e172d63f6bd9dc16a04866a81dac4e07225ae84","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-04-07 16:03:23.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"a1da7f5c8ae5750be9ce174a81c839403a576945","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-07 16:25:28.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b22e8a5b940b42ce934338ada15f91d7\n\n- openstack-tox-py310-arm64 https://zuul.opendev.org/t/openstack/build/5acca2b3e034417790fafd4f04e410ad : SUCCESS in 19m 24s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/db9d37338fc54b498ed850d0fd9d052a : SUCCESS in 14m 54s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/aefa3ae568a9435e99d6a1a4c0b761b1 : SUCCESS in 20m 27s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"2c551c2a40497d5c01c87477b652b38ec4bfe364","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-04-07 16:27:24.000000000","message":"Topic set to bug/2142138","accounts_in_message":[],"_revision_number":1},{"id":"5078f96239113fee92d6e65bfd73b3ad7eb50fb9","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-07 17:29:39.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/996fde5f1bcc4285a2cca60873e610a7\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/cd9ee3d1caf943f39fde98c7776118d3 : SUCCESS in 12m 45s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/21f65aff9aef4c10a61339df0ca04662 : SUCCESS in 4m 52s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/de8e00f72c0d4224b43f8eb3bc823952 : SUCCESS in 9m 05s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/3a748915cf41490abd7028285d2736c6 : SUCCESS in 11m 15s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/a59eb8fd231f4332887421027d2a7156 : SUCCESS in 9m 01s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0e0cf4ca03854928b745d7bf22e2a713 : SUCCESS in 6m 51s\n- grenade https://zuul.opendev.org/t/openstack/build/a1813cd396d8484bbba2e6fbe651ff25 : SUCCESS in 53m 47s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/689571ba352d450c8347006c2814c8ac : SUCCESS in 1h 24m 29s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/bca7d3bb05fc4478b8ab02184d0c866c : SUCCESS in 15m 29s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/22312c2327a64938be6752b0a150fc9f : SUCCESS in 29m 47s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/3a842266cb38412a854e158d991062bb : FAILURE in 20m 37s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/5b24f3703e5e4b44afb09097da177079 : FAILURE in 28m 34s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/200580f062664fdbb730913158e7acd3 : SUCCESS in 30m 20s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/0ac11029025a4c4691597787be0678c7 : SUCCESS in 19m 38s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/a09a2eb1483640f2b9abc9db3d423ff0 : SUCCESS in 28m 57s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/11c395aba7aa48fc88786c309ba232b1 : SUCCESS in 55m 09s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/9f20e2261e1a4f0888fbe887a41e226a : FAILURE in 40m 46s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/8612871dfded4a6295c5043de0308526 : SUCCESS in 7m 36s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"cb7d5b294e29929cb21c26827944fda52b8eb670","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-04-08 10:19:36.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"5a7ce331055e7e9586cd7d0203fc9c149af267fd","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-04-08 15:25:07.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"e05ecb2b2c93f796f84a48f53d81016545d06fe3","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 15:25:32.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"79de3a3dbaaa00da0417bd9a30a7154bedd94caa","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 17:21:41.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/a580415951ce46e7ba5b7451e72ec96d\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/3cb08ad0115844ea8c222666d8a3416e : SUCCESS in 5m 14s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/e62d67ed53454f03a3aa15a480d6fe29 : SUCCESS in 10m 53s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/843e09a5cc63438fa2db03731b695c10 : SUCCESS in 6m 54s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/81bcb61f7e55436681641d671a7b111a : SUCCESS in 6m 41s\n- grenade https://zuul.opendev.org/t/openstack/build/3ee8553addc24680b11155e065cd6571 : SUCCESS in 47m 44s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/6c5f6c2834064e92bc0933ab3aefbf28 : SUCCESS in 1h 51m 27s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/6dae8f4c36424b2f8694a2675d6cd115 : SUCCESS in 29m 25s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/a96d11f9b42b44aea40d819c5959de83 : SUCCESS in 30m 18s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/90f30da7f4fb490fbf7cd0171714200e : SUCCESS in 55m 45s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/df322dc8e4b344479932fc7678522c30 : FAILURE in 19m 00s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"6a04bb68e508e5d171d93b598b4b5abf1d6f7431","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 17:21:42.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"a989fffdf53d14caf3adbba460498ea041fe86cb","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 17:23:07.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d0fe53341c094efcb1c78fa9be624a9e\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a12c46d2a2cd47feb85355b6c9a668fb : SUCCESS in 1m 09s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"e88f3888b57786a36e98f2bc87337b7d983ad4a9","revisions":{"e88f3888b57786a36e98f2bc87337b7d983ad4a9":{"kind":"REWORK","_number":1,"created":"2026-04-07 16:03:23.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/87/983587/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/87/983587/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/87/983587/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/87/983587/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/87/983587/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/87/983587/1"}}},"commit":{"parents":[{"commit":"91688d9dde8fcd09e6484423466a4513dbff5df7","subject":"Merge \"Remove V2 get_catalog from catalog driver\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/91688d9dde8fcd09e6484423466a4513dbff5df7"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-02-26 09:09:18.000000000","tz":60},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-04-07 16:03:07.000000000","tz":120},"subject":"Prevent unauthorized EC2 credential creation and deletion","message":"Prevent unauthorized EC2 credential creation and deletion\n\nA restricted application credential could be used to create EC2\ncredentials granting full user access to S3, bypassing the role\nrestriction. Add the same _check_unrestricted_application_credential\nguard that already protects application credential create/delete\nendpoints.\n\nAdditionally, tighten the ec2_create_credential and ec2_delete_credential\npolicies to require at least member role, as these are write operations\nthat should not be accessible to reader-role users regardless of whether\nthey are using an application credential.\n\nChange-Id: Ib6904ec9f1bc069a9f607d39814b1d2633c17f53\nCloses-Bug: #2142138\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/e88f3888b57786a36e98f2bc87337b7d983ad4a9"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/e88f3888b57786a36e98f2bc87337b7d983ad4a9"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}