)]}'
{"id":"openstack%2Fkeystone~983597","triplet_id":"openstack%2Fkeystone~unmaintained%2F2024.1~Ib6904ec9f1bc069a9f607d39814b1d2633c17f53","project":"openstack/keystone","branch":"unmaintained/2024.1","topic":"lp2142138-unmaintained-2024.1","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-04-10 18:43:21.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-04-10 18:43:21.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ib6904ec9f1bc069a9f607d39814b1d2633c17f53","subject":"Prevent unauthorized EC2 credential creation and deletion","status":"MERGED","created":"2026-04-07 16:37:56.000000000","updated":"2026-04-10 18:46:46.000000000","submitted":"2026-04-10 18:43:21.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":3,"unresolved_comment_count":1,"has_review_started":true,"submission_id":"983597-lp2142138-unmaintained-2024.1","meta_rev_id":"6f9c00e5af5a4417d102405ab52b96f0e5943d00","_number":983597,"virtual_id_number":983597,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-04-10 18:43:21.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"all":[{"value":2,"date":"2026-04-09 16:16:28.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"all":[{"value":1,"date":"2026-04-09 16:16:28.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-04-07 16:37:56.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-04-07 18:07:54.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-04-09 07:15:55.000000000","updated_by":{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},"reviewer":{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},"state":"CC"},{"updated":"2026-04-09 16:16:28.000000000","updated_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"reviewer":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"state":"REVIEWER"}],"messages":[{"id":"630c2add4b113fc270bc6ac0a0380926abaf4836","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-04-07 16:37:56.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"8dd369439ddb9d4655362722b4a1d00732aeda41","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-07 18:07:54.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/a4e3544699134580ae494803004e62e1\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/fbfd918888c14d1a844c2e449ef2accb : FAILURE in 4m 16s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/bc94624af37041a4b5397ea0eaab4407 : FAILURE in 4m 33s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/83e8d3409311455092688bdc1320f3cd : SUCCESS in 11m 07s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/6df38e06f986425dbd0d560c6206f717 : FAILURE in 5m 15s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3f570139f99f49b2838c078932d78f2d : FAILURE in 5m 13s\n- grenade https://zuul.opendev.org/t/openstack/build/10d43ebca6ed49daa40f7fe95425f69c : SUCCESS in 55m 34s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/59e42ea4d28c4ee491ed5b4658eea749 : SUCCESS in 1h 24m 56s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/82d88562aced41fc8ef49fa2c3aaad21 : SUCCESS in 12m 30s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/ab802541e04a48b7b352c069eb8f0d71 : FAILURE in 38m 15s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/138e2d82c583409e901690f713e8326e : FAILURE in 17m 32s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/7eed63e708674f59a925cdd3f4479cc5 : SUCCESS in 14m 37s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/4906203a118045b4a1c5b1169371de2d : FAILURE in 7m 05s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/6586cda5586b4f8880d08162525f9466 : FAILURE in 19m 14s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/720db7533fde4d65b205fc65bf45e444 : SUCCESS in 37m 14s\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/8671d97e7f3a4cda805f57abcaabfcef : SUCCESS in 20m 07s","accounts_in_message":[],"_revision_number":1},{"id":"b9ce09d1183cc982abc069b65cb996ef1b0115e3","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"real_author":{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},"date":"2026-04-09 07:15:16.000000000","message":"Patch Set 2: Patch Set 1 was rebased on behalf of \u003cGERRIT_ACCOUNT_27900\u003e\n\nOutdated Votes:\n* Verified-1\n","accounts_in_message":[{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"_revision_number":2},{"id":"29c29149adc75f21820298b07d141c561e249f13","author":{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},"date":"2026-04-09 07:15:55.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"2cda0b40bddb6bd79a5f064819c136d1b744568e","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-09 08:07:33.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/c5c8b8d3175e41aba5bd6633cb6cdd88\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/ceee97d790c6438e9b7c142361b06c73 : FAILURE in 4m 17s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5ee9b84c8e0743fe80c3b833f606b29d : FAILURE in 4m 32s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/6019ddcc10d24e23bca57a91d41549a3 : SUCCESS in 11m 38s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/1816700d972e44f49c35d6261a574064 : FAILURE in 4m 47s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/34712ee67c814917a3df5d6e4aea1357 : FAILURE in 4m 32s\n- grenade https://zuul.opendev.org/t/openstack/build/a64c763e279a4086806a6633736faf40 : SUCCESS in 51m 47s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/15faca0e4a2645e78ef837910cc670ed : SUCCESS in 49m 18s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/ac2189bc57ef46c7b869210c352478d7 : SUCCESS in 27m 24s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/41ab8ac530b44768b023f318e786d85f : FAILURE in 43m 00s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/58322273f36e4894b99789a426ea5d89 : FAILURE in 22m 36s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/5a1fe40006d34c959efafcd1b067aab7 : SUCCESS in 15m 29s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/7e776a902f0046c79f3e71149f0e1bac : FAILURE in 8m 49s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/78f8d865ef6e4c45968ccf26c96e5861 : FAILURE in 8m 05s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/6a305e5d35e14658a88cf8a8a21bfd5b : SUCCESS in 31m 06s\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/4073542bf4ba4e0898a71e44ae32b113 : SUCCESS in 29m 15s","accounts_in_message":[],"_revision_number":2},{"id":"c3904420f0cffb0406b88014decceafcab0710b0","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"real_author":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"date":"2026-04-09 16:07:59.000000000","message":"Patch Set 3: Patch Set 2 was rebased on behalf of \u003cGERRIT_ACCOUNT_27900\u003e\n\nOutdated Votes:\n* Verified-1\n","accounts_in_message":[{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"_revision_number":3},{"id":"e51170a4970292392b96954939ca533bc4d262c5","author":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"date":"2026-04-09 16:16:28.000000000","message":"Patch Set 3: Code-Review+2 Workflow+1\n\n(2 comments)","accounts_in_message":[],"_revision_number":3},{"id":"795ae804680f25fc0d17536f7038aba07e0f9391","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-09 17:43:35.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/59223846e06848f699658c6ad4fbfff7\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/9721a7cf13f74b2f9870a42d894b22a0 : SUCCESS in 10m 51s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a5c4841505e24430bc8131f649078174 : SUCCESS in 6m 10s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/518c2cda1840452c9891f7ca0803d6cd : SUCCESS in 11m 44s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/8769c5b4696d4ae9aefe8c63395866eb : SUCCESS in 7m 15s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/55f4f90d9e794657b5b894fe26bdf99a : SUCCESS in 9m 39s\n- grenade https://zuul.opendev.org/t/openstack/build/01a9656486d3480c8eab7f8d0c84c8a6 : SUCCESS in 1h 06m 55s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a70f3d7ba03a4b8da20339b596dfea52 : SUCCESS in 1h 32m 57s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/74fbf43e3ebf4455a26ba8d48da408df : SUCCESS in 29m 02s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/1f53b00e1695491eb7dc9d5d32ab4306 : FAILURE in 41m 33s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/c67d0a6a51dd45589af16c90950f7561 : FAILURE in 14m 45s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/36fbd3b897da4596b58791a59e755d51 : SUCCESS in 28m 49s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/7bbc033f479846a185522faa5507bc5d : FAILURE in 8m 57s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/8d61f1a38d3449da88f51ef49fa8e0eb : FAILURE in 18m 04s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/20015708283e47ff856e9eaa936ba3e8 : SUCCESS in 39m 59s\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/ab35630cc5be4994bfdabbe6ef54d474 : SUCCESS in 34m 07s","accounts_in_message":[],"_revision_number":3},{"id":"96b1f2a60624bba10e5ff765899d087f2ed8432b","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-10 16:03:01.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"bf660cf342089d967821ccf6c87a77e108f615ff","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-10 18:43:21.000000000","message":"Patch Set 3: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/e12826fc61ac4d4080d7bf573f34c5d2\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/49902ae42ec44799b0013dc7dba9635a : SUCCESS in 5m 28s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/8664b8bb64794d8c9aaae4cb1fe409aa : SUCCESS in 9m 27s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/141e2668a3d24f7a8bff24938f41fab7 : SUCCESS in 12m 55s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/87231ef03da447caa27142d44586f596 : SUCCESS in 12m 10s\n- grenade https://zuul.opendev.org/t/openstack/build/ecebf8d7827b4ddeb737dad5c5e84252 : SUCCESS in 26m 04s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/5c9e109e42384bdfb271369839d10059 : SUCCESS in 1h 30m 26s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/12eb28dcd10a4db09d8ef2e530bef7cf : SUCCESS in 28m 45s\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/ac11617a94194e709b525456a78b3e68 : SUCCESS in 20m 27s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/50886f60293b4946a55f30f31aa44055 : SUCCESS in 1h 06m 57s","accounts_in_message":[],"_revision_number":3},{"id":"e26a2dbf8ad7bb2b421d8921eb668ca9a2d94bbb","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-10 18:43:21.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":3},{"id":"6f9c00e5af5a4417d102405ab52b96f0e5943d00","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-10 18:46:46.000000000","message":"Patch Set 3:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/559ea3ac29854aa4a2dcaf8126625cdc\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/79bc95c2e58644138ffb80742f1c75dd : SUCCESS in 1m 06s","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"adedc84594907824fcce34fe0617b8b03fbd576f","revisions":{"e0453a5cf65f5cb601c3a89b7b8e76149dd56ae9":{"kind":"REWORK","_number":1,"created":"2026-04-07 16:37:56.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/97/983597/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/97/983597/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/983597/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/983597/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/983597/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/97/983597/1"}}},"commit":{"parents":[{"commit":"4f51cdcc5c1f4f082a5fffd470d1f65b6fa65ecd","subject":"Add service user authentication to ec2 and s3 endpoints","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4f51cdcc5c1f4f082a5fffd470d1f65b6fa65ecd"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-02-26 09:09:18.000000000","tz":60},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-04-07 16:37:44.000000000","tz":120},"subject":"Prevent unauthorized EC2 credential creation and deletion","message":"Prevent unauthorized EC2 credential creation and deletion\n\nA restricted application credential could be used to create EC2\ncredentials granting full user access to S3, bypassing the role\nrestriction. Add the same _check_unrestricted_application_credential\nguard that already protects application credential create/delete\nendpoints.\n\nAdditionally, tighten the ec2_create_credential and ec2_delete_credential\npolicies to require at least member role, as these are write operations\nthat should not be accessible to reader-role users regardless of whether\nthey are using an application credential.\n\nChange-Id: Ib6904ec9f1bc069a9f607d39814b1d2633c17f53\nCloses-Bug: #2142138\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/e0453a5cf65f5cb601c3a89b7b8e76149dd56ae9"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/e0453a5cf65f5cb601c3a89b7b8e76149dd56ae9"}]},"branch":"refs/heads/unmaintained/2024.1"},"12f87238435ccf31c09c2063ca5c13dd8b27bad8":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-04-09 07:15:16.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"real_uploader":{"_account_id":15197,"name":"Pierre Riteau","email":"pierre@stackhpc.com","username":"priteau","status":"StackHPC"},"ref":"refs/changes/97/983597/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/97/983597/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/983597/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/983597/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/983597/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/97/983597/2"}}},"commit":{"parents":[{"commit":"846998f683988562705b810add81a39448b03505","subject":"Ignore typing on the single import","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/846998f683988562705b810add81a39448b03505"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-02-26 09:09:18.000000000","tz":60},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-04-09 07:15:16.000000000","tz":0},"subject":"Prevent unauthorized EC2 credential creation and deletion","message":"Prevent unauthorized EC2 credential creation and deletion\n\nA restricted application credential could be used to create EC2\ncredentials granting full user access to S3, bypassing the role\nrestriction. Add the same _check_unrestricted_application_credential\nguard that already protects application credential create/delete\nendpoints.\n\nAdditionally, tighten the ec2_create_credential and ec2_delete_credential\npolicies to require at least member role, as these are write operations\nthat should not be accessible to reader-role users regardless of whether\nthey are using an application credential.\n\nChange-Id: Ib6904ec9f1bc069a9f607d39814b1d2633c17f53\nCloses-Bug: #2142138\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/12f87238435ccf31c09c2063ca5c13dd8b27bad8"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/12f87238435ccf31c09c2063ca5c13dd8b27bad8"}]},"branch":"refs/heads/unmaintained/2024.1","description":"Rebase"},"adedc84594907824fcce34fe0617b8b03fbd576f":{"kind":"TRIVIAL_REBASE","_number":3,"created":"2026-04-09 16:07:59.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"real_uploader":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"ref":"refs/changes/97/983597/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/97/983597/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/983597/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/983597/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/97/983597/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/97/983597/3"}}},"commit":{"parents":[{"commit":"08e8e523b5a8a7fa6c71a521534e8eab7087ed2c","subject":"Fix gate (pkg_resource, pep8)","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/08e8e523b5a8a7fa6c71a521534e8eab7087ed2c"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-02-26 09:09:18.000000000","tz":60},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-04-09 16:07:59.000000000","tz":0},"subject":"Prevent unauthorized EC2 credential creation and deletion","message":"Prevent unauthorized EC2 credential creation and deletion\n\nA restricted application credential could be used to create EC2\ncredentials granting full user access to S3, bypassing the role\nrestriction. Add the same _check_unrestricted_application_credential\nguard that already protects application credential create/delete\nendpoints.\n\nAdditionally, tighten the ec2_create_credential and ec2_delete_credential\npolicies to require at least member role, as these are write operations\nthat should not be accessible to reader-role users regardless of whether\nthey are using an application credential.\n\nChange-Id: Ib6904ec9f1bc069a9f607d39814b1d2633c17f53\nCloses-Bug: #2142138\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/adedc84594907824fcce34fe0617b8b03fbd576f"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/adedc84594907824fcce34fe0617b8b03fbd576f"}]},"branch":"refs/heads/unmaintained/2024.1","description":"Rebase"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}