)]}'
{"id":"openstack%2Fkeystone~983588","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~Ib6904ec9f1bc069a9f607d39814b1d2633c17f53","project":"openstack/keystone","branch":"stable/2025.2","topic":"bug/2142138","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-04-08 17:26:24.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-04-08 17:26:24.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ib6904ec9f1bc069a9f607d39814b1d2633c17f53","subject":"Prevent unauthorized EC2 credential creation and deletion","status":"MERGED","created":"2026-04-07 16:09:44.000000000","updated":"2026-04-08 17:27:32.000000000","submitted":"2026-04-08 17:26:24.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"983588-bug/2142138","meta_rev_id":"4e9d7c5b67623bd08a21b56d178eecd18894011d","_number":983588,"virtual_id_number":983588,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-04-08 17:26:24.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"all":[{"value":2,"date":"2026-04-08 15:26:34.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":2,"date":"2026-04-08 10:20:06.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"all":[{"value":1,"date":"2026-04-08 15:26:34.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-04-07 16:09:44.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-04-07 17:27:55.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-04-08 15:26:34.000000000","updated_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"}],"messages":[{"id":"62683c46eea88492afdc0dadae90351e760d39c5","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-04-07 16:09:44.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"b1ec8c06c19a4ca97af1b6c119532c1520becedb","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-04-07 16:27:39.000000000","message":"Topic 2142138 removed","accounts_in_message":[],"_revision_number":1},{"id":"019699b8e90aa083811743676f6f8bef0c5a12be","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-04-07 16:27:43.000000000","message":"Topic set to bug/2142138","accounts_in_message":[],"_revision_number":1},{"id":"ea3bf63ed0d5e668e5820f334e20522b797c3c9e","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-07 17:27:55.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/41ab9bd23f8b4c06bec4ab8ed22e3ad8\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/6cc3bdbc60b64e0fb6145b3daf5cc055 : SUCCESS in 12m 12s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/6604b23cc62f4cb084ed87e966b9814d : SUCCESS in 3m 48s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/7a2d112b8c8e4a389b7ed1abf185b536 : SUCCESS in 8m 11s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/315a65ca09fb4446a2d82c40dafaf1f9 : SUCCESS in 9m 01s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/30b1af9cee0d41d58e0ea0ca0c772ac6 : SUCCESS in 10m 33s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/63f9b58c2769436b9c8efc1db08a59b4 : SUCCESS in 11m 52s\n- grenade https://zuul.opendev.org/t/openstack/build/b2a6b1148f074a6aa138ab6b509adcce : SUCCESS in 1h 12m 28s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/079cb3d0c4a94850b6780fac61ba506b : SUCCESS in 58m 26s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/f71c5ba09eab4c518cb596de99dfc682 : SUCCESS in 7m 56s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/d2c9315f4ac6474594ced0f3454b93ef : SUCCESS in 23m 10s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/1b822fb9f6694bf7a9107f9b01f82d3d : FAILURE in 9m 24s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/a0543ce9122b43b38ba04c29f77a6353 : FAILURE in 24m 36s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/8309004ab14b4320842ac43f56834d68 : SUCCESS in 14m 17s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/e9360d13df114294a13f610d190a01bc : SUCCESS in 33m 03s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/912e4a0621244712b7745d38df79679f : SUCCESS in 36m 08s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/91f5236e09a6471bb760e8d5d28b1c97 : SUCCESS in 1h 00m 48s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/100698eab3354b7aac73ef246e2c5961 : FAILURE in 18m 22s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/0a51b7166a1841519651be9df7ac09f4 : FAILURE in 7m 52s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"d9a8f5adb324ee2168a170f3dfcb7e14f5992ff8","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-04-08 10:20:06.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"186f8904ec64ca6b8d6a07f58c84b47891231d3b","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-04-08 15:26:34.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"e5a6732509e01f1a1023c43234924c7e77a544b1","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 15:27:01.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"d1724147d2d3f16f4d040f459c21867aee7f64c6","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 17:26:24.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8da426fd2e52484495cde38bdc84192b\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/bc959939b6b5468c9a5792d92789b679 : SUCCESS in 3m 35s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/8775115392e547e7ae27b4c4dec9924d : SUCCESS in 11m 53s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/dc20d6df7e9c47d2ba2ecc97917423b5 : SUCCESS in 7m 48s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ac4fbc6272924aea9259b3325b83842f : SUCCESS in 13m 09s\n- grenade https://zuul.opendev.org/t/openstack/build/3b0cf6f0982749e89f9b1d244bdd2341 : SUCCESS in 44m 53s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/dbff82f2a7524b8a82030bfb388c3e84 : SUCCESS in 1h 54m 36s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/db233eb1f99240549cb6102318fc4549 : SUCCESS in 17m 00s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/aa1b1860aad544348d0bb99fdf54e574 : SUCCESS in 31m 00s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/66291d5f183f4df8b66e084396a6f968 : SUCCESS in 41m 52s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/450224dbfc134353b26accd3d5417dbb : FAILURE in 21m 30s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"66002d8a14c29d61b561d95382822c542943e680","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 17:26:24.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"4e9d7c5b67623bd08a21b56d178eecd18894011d","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 17:27:32.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/ff983bb2cdf64b7db45a659f9c93318f\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3f4e6c35d1474cc8b2dce18fc0265e52 : SUCCESS in 53s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"24b0e1190b04701614659a74d5a5b644902a77b8","revisions":{"24b0e1190b04701614659a74d5a5b644902a77b8":{"kind":"REWORK","_number":1,"created":"2026-04-07 16:09:44.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/88/983588/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/88/983588/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/983588/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/983588/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/983588/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/88/983588/1"}}},"commit":{"parents":[{"commit":"0e522f5d4b6db5c57ed50c26e455be9382c28db5","subject":"Fix OIDC federation UTF-8 double-encoding of non-ASCII characters","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0e522f5d4b6db5c57ed50c26e455be9382c28db5"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-02-26 09:09:18.000000000","tz":60},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-04-07 16:09:37.000000000","tz":120},"subject":"Prevent unauthorized EC2 credential creation and deletion","message":"Prevent unauthorized EC2 credential creation and deletion\n\nA restricted application credential could be used to create EC2\ncredentials granting full user access to S3, bypassing the role\nrestriction. Add the same _check_unrestricted_application_credential\nguard that already protects application credential create/delete\nendpoints.\n\nAdditionally, tighten the ec2_create_credential and ec2_delete_credential\npolicies to require at least member role, as these are write operations\nthat should not be accessible to reader-role users regardless of whether\nthey are using an application credential.\n\nChange-Id: Ib6904ec9f1bc069a9f607d39814b1d2633c17f53\nCloses-Bug: #2142138\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/24b0e1190b04701614659a74d5a5b644902a77b8"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/24b0e1190b04701614659a74d5a5b644902a77b8"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}