)]}'
{"id":"openstack%2Fkeystone~983589","triplet_id":"openstack%2Fkeystone~stable%2F2025.1~Ib6904ec9f1bc069a9f607d39814b1d2633c17f53","project":"openstack/keystone","branch":"stable/2025.1","topic":"bug/2142138","attention_set":{},"removed_from_attention_set":{"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2026-04-08 15:25:29.000000000","reason":"\u003cGERRIT_ACCOUNT_7414\u003e replied on the change","reason_account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-04-08 19:04:20.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-04-08 19:04:20.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ib6904ec9f1bc069a9f607d39814b1d2633c17f53","subject":"Prevent unauthorized EC2 credential creation and deletion","status":"MERGED","created":"2026-04-07 16:11:31.000000000","updated":"2026-04-08 19:07:27.000000000","submitted":"2026-04-08 19:04:20.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"983589-bug/2142138","meta_rev_id":"8ca02a20a02d59ff7739d15463df93a7f88144d8","_number":983589,"virtual_id_number":983589,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-04-08 19:04:20.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"recommended":{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},"all":[{"value":1,"date":"2026-04-08 11:10:26.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},{"value":2,"date":"2026-04-08 15:25:29.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-04-08 10:19:50.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":1,"date":"2026-04-08 08:51:40.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":1,"default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"all":[{"value":0,"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},{"value":1,"date":"2026-04-08 15:25:29.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-04-07 16:11:31.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-04-07 17:55:18.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-04-08 08:51:40.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"state":"REVIEWER"},{"updated":"2026-04-08 08:51:40.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"},{"updated":"2026-04-08 11:10:26.000000000","updated_by":{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},"reviewer":{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},"state":"REVIEWER"}],"messages":[{"id":"281ddc1d9f0b59f60fe6337b1bc14442dbe8ff52","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-04-07 16:11:31.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"7f625ad6ed9a9c06982206a79b721ba1929c8e01","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-04-07 16:28:04.000000000","message":"Topic 2142138_20251 removed","accounts_in_message":[],"_revision_number":1},{"id":"629b1dc1e099c6fc2cbb1ad9dfcca6582535a3e0","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-04-07 16:28:07.000000000","message":"Topic set to bug/2142138","accounts_in_message":[],"_revision_number":1},{"id":"058dcef62ac4bfec33637b411cf5af5108065876","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-07 17:55:18.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/f2dd2f0930d8487ab874fa4eeb091b75\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/11e7af01caec4328b170e1d62e0495f8 : FAILURE in 4m 30s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f38812031976448a806789affb35dc5a : FAILURE in 5m 14s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/9270fb66088e483985629fc39092973d : FAILURE in 5m 04s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/dab5897a4a2649b3abfee8147304035d : FAILURE in 4m 31s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3b537ba8f73b4f6f98dff3804d4164b3 : FAILURE in 7m 52s\n- grenade https://zuul.opendev.org/t/openstack/build/b967d5b432064805828f96d25d2b5042 : SUCCESS in 42m 22s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/b4f74ff418e6451d95917bf4ba1ce079 : SUCCESS in 1h 38m 54s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/7907e2f6fbe744e4b37428bd7ea463a3 : SUCCESS in 32m 40s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/d5ea39178f5742be9535a297cce7a289 : FAILURE in 37m 16s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/7b62543701f3460db2e0f7d53173c16d : FAILURE in 16m 45s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/0a5afdbd09a44201af5d51364cb2200f : SUCCESS in 28m 14s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/c934da18b2a64a05906cf03ca37e66d8 : FAILURE in 14m 28s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/e7cf5739b5314c1c9e5e330259e5a100 : SUCCESS in 40m 30s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/996a9bd7cf2a4513b50e69ab96406f62 : SUCCESS in 59m 53s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/5e337b9d2dbc4129945179be17e324db : RETRY_LIMIT in 5m 47s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/fe396556230445ac91716a7300446193 : SUCCESS in 15m 44s","accounts_in_message":[],"_revision_number":1},{"id":"352f0477fc5f18537a48ad510d7d8c952ce2569a","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"real_author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"date":"2026-04-08 08:51:20.000000000","message":"Patch Set 2: Patch Set 1 was rebased on behalf of \u003cGERRIT_ACCOUNT_27900\u003e\n\nOutdated Votes:\n* Verified-1\n","accounts_in_message":[{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"_revision_number":2},{"id":"0e6c8ba1d71987ba09a576e2990ecbfff130f319","author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"date":"2026-04-08 08:51:40.000000000","message":"Patch Set 2: Code-Review+1","accounts_in_message":[],"_revision_number":2},{"id":"38bda674d6b5d7717828ac81729ed7412d5d63ef","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 10:12:13.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/5e3e907611ae483ea09cb9c0233b6d52\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/d379f8c50069465a9076ca315be44e5c : SUCCESS in 15m 57s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/d6530d7b625e4081a5ad14ff2530345b : SUCCESS in 9m 05s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/c3753f6acc2840ba9869b158c5e5abad : SUCCESS in 11m 51s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/a4a0d4f052804b549ad18de193dc2163 : SUCCESS in 7m 49s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/54f9cb26e0e64212990fc45849840d7d : SUCCESS in 13m 24s\n- grenade https://zuul.opendev.org/t/openstack/build/1cd118d67e4f428f87cdaa9acccb7e8c : SUCCESS in 58m 17s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/ef45dc22bc374deab8c6642543283a7b : SUCCESS in 1h 19m 57s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/a92f8f9f06d74172a31d68b40940f285 : SUCCESS in 19m 48s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/14c45b0452fa427abc1a1ea9acc8ac1f : FAILURE in 36m 00s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/8f85e7e5dc534d979d815271a6902e33 : FAILURE in 19m 12s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/9ef95423b66445b0b41d4974ebae35f8 : SUCCESS in 19m 04s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/3a313917828140c38cfb4cd4afe0ac01 : FAILURE in 16m 21s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/8db586c569bc41e78de761643903ca01 : SUCCESS in 26m 02s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/a48e67533a5c416bae2ad861b31ed645 : SUCCESS in 56m 37s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/2b81ca360c4b4a459d0dead21137ff68 : FAILURE in 4m 07s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/1bfc59b1ca2f429a93f89ba7e8c74a3c : SUCCESS in 35m 11s","accounts_in_message":[],"_revision_number":2},{"id":"4c62e42d65dad4933f36a01ccd5ed5fed7680a81","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-04-08 10:19:50.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"d7b2b356b0efef8efd194c3d845ea019a6f9a68a","author":{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},"date":"2026-04-08 11:10:26.000000000","message":"Patch Set 2: Code-Review+1","accounts_in_message":[],"_revision_number":2},{"id":"c43548da3c7f4495bd05432c802ba4569bcdd2d9","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-04-08 15:25:29.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"a6e88d9c063705a2ac0b8d49ad9f726940dfda96","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 16:58:11.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"afb5b268911dd6705f8d1e915ea1849859805f4e","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 19:04:20.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2c5d8da6499d482395d27717cca185a1\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c169ab79ec8745d59f7d6581eb9e4077 : SUCCESS in 7m 29s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/fd12fb6bcf634a3db5f03732e871421c : SUCCESS in 10m 28s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/c9890c8111dc4c9a864c5c91b0a0663a : SUCCESS in 10m 52s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e5dd0906433d429587701e5af2427afd : SUCCESS in 7m 08s\n- grenade https://zuul.opendev.org/t/openstack/build/d80d1d4ca6ab4dfaa730698fc71541c7 : SUCCESS in 57m 07s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/08055f13e9b0430cbc3a43ad06b14b89 : SUCCESS in 1h 39m 59s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/d836621cd7f94ca0b2fe8f241953165b : SUCCESS in 25m 56s\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/3a92bf2c4fb24adab23ded91af57d66e : SUCCESS in 28m 20s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/08b0e9f325e74fe09fe4761c59e9040f : SUCCESS in 39m 44s","accounts_in_message":[],"_revision_number":2},{"id":"0d27ed724efb3582063118cffe4e49cd48a22f33","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 19:04:20.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"8ca02a20a02d59ff7739d15463df93a7f88144d8","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 19:07:27.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3cd32894356a4ddea76b46218320b9dd\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/826ec6072f874571a290d9a143c4c9e7 : SUCCESS in 50s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"4da764003370b2d8b61a214aecf6183e7b53ecd7","revisions":{"42e5c9ae0b58c1746749567c5f65657c5d1326c7":{"kind":"REWORK","_number":1,"created":"2026-04-07 16:11:31.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/89/983589/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/89/983589/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/983589/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/983589/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/983589/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/89/983589/1"}}},"commit":{"parents":[{"commit":"ea188589f9b8fe42e708cc065d34290e79f354e5","subject":"Fix trusts jsonschema to support additional properties","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/ea188589f9b8fe42e708cc065d34290e79f354e5"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-02-26 09:09:18.000000000","tz":60},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-04-07 16:11:17.000000000","tz":120},"subject":"Prevent unauthorized EC2 credential creation and deletion","message":"Prevent unauthorized EC2 credential creation and deletion\n\nA restricted application credential could be used to create EC2\ncredentials granting full user access to S3, bypassing the role\nrestriction. Add the same _check_unrestricted_application_credential\nguard that already protects application credential create/delete\nendpoints.\n\nAdditionally, tighten the ec2_create_credential and ec2_delete_credential\npolicies to require at least member role, as these are write operations\nthat should not be accessible to reader-role users regardless of whether\nthey are using an application credential.\n\nChange-Id: Ib6904ec9f1bc069a9f607d39814b1d2633c17f53\nCloses-Bug: #2142138\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/42e5c9ae0b58c1746749567c5f65657c5d1326c7"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/42e5c9ae0b58c1746749567c5f65657c5d1326c7"}]},"branch":"refs/heads/stable/2025.1"},"4da764003370b2d8b61a214aecf6183e7b53ecd7":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-04-08 08:51:20.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"real_uploader":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"ref":"refs/changes/89/983589/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/89/983589/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/983589/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/983589/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/983589/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/89/983589/2"}}},"commit":{"parents":[{"commit":"d074c49d2836ea7f82b6dfa46cc1da1bb5f045ec","subject":"fix(pep8): pin setuptools\u003c82 for flake8-import-order compatibility","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d074c49d2836ea7f82b6dfa46cc1da1bb5f045ec"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-02-26 09:09:18.000000000","tz":60},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-04-08 08:51:20.000000000","tz":0},"subject":"Prevent unauthorized EC2 credential creation and deletion","message":"Prevent unauthorized EC2 credential creation and deletion\n\nA restricted application credential could be used to create EC2\ncredentials granting full user access to S3, bypassing the role\nrestriction. Add the same _check_unrestricted_application_credential\nguard that already protects application credential create/delete\nendpoints.\n\nAdditionally, tighten the ec2_create_credential and ec2_delete_credential\npolicies to require at least member role, as these are write operations\nthat should not be accessible to reader-role users regardless of whether\nthey are using an application credential.\n\nChange-Id: Ib6904ec9f1bc069a9f607d39814b1d2633c17f53\nCloses-Bug: #2142138\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4da764003370b2d8b61a214aecf6183e7b53ecd7"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4da764003370b2d8b61a214aecf6183e7b53ecd7"}]},"branch":"refs/heads/stable/2025.1","description":"Rebase"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}