)]}'
{"id":"openstack%2Fkeystone~989488","triplet_id":"openstack%2Fkeystone~master~Ib9816edd9780b91ffdccb117716d800d00b4c880","project":"openstack/keystone","branch":"master","topic":"fix/ec2-credential-project-authorization","hashtags":[],"change_id":"Ib9816edd9780b91ffdccb117716d800d00b4c880","subject":"Validate project access when creating EC2 credentials","status":"ABANDONED","created":"2026-05-21 08:21:45.000000000","updated":"2026-05-21 08:24:35.000000000","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"51ef7cef336426f26ae857601a9940dc94da4a86","_number":989488,"virtual_id_number":989488,"owner":{"_account_id":9725,"name":"Dong Ma","email":"winterma.dong@gmail.com","username":"larainema"},"actions":{},"labels":{"Verified":{"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{},"pending_reviewers":{},"reviewer_updates":[],"messages":[{"id":"02a40375767c344658d48a1c92e2eba6b7a5b4a1","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":9725,"name":"Dong Ma","email":"winterma.dong@gmail.com","username":"larainema"},"date":"2026-05-21 08:21:45.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"51ef7cef336426f26ae857601a9940dc94da4a86","tag":"autogenerated:gerrit:abandon","author":{"_account_id":9725,"name":"Dong Ma","email":"winterma.dong@gmail.com","username":"larainema"},"date":"2026-05-21 08:24:35.000000000","message":"Abandoned\n\nDuplicate upload; superseded by change 973225.","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"8e3143270f326a7ebb2bfe623683a6705f7c46bd","revisions":{"8e3143270f326a7ebb2bfe623683a6705f7c46bd":{"kind":"REWORK","_number":1,"created":"2026-05-21 08:21:45.000000000","uploader":{"_account_id":9725,"name":"Dong Ma","email":"winterma.dong@gmail.com","username":"larainema"},"ref":"refs/changes/88/989488/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/88/989488/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/989488/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/989488/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/88/989488/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/88/989488/1"}}},"commit":{"parents":[{"commit":"2230026f77a8ed50493d2d58be9120910ceb2089","subject":"Merge \"Fix keystone scope flag in tempest.conf\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2230026f77a8ed50493d2d58be9120910ceb2089"}]}],"author":{"name":"Dong Ma","email":"winterma.dong@gmail.com","date":"2026-01-13 12:37:47.000000000","tz":480},"committer":{"name":"Dong Ma","email":"winterma.dong@gmail.com","date":"2026-05-21 08:21:22.000000000","tz":480},"subject":"Validate project access when creating EC2 credentials","message":"Validate project access when creating EC2 credentials\n\nThe EC2 credential creation API did not validate that the user has any role assignments in the target project. This allowed users to create EC2 credentials for any project they could resolve the ID for, even if they had no access to that project.\n\nWhile these credentials would fail during authentication (EC2 token validation checks for role assignments), this still allowed database pollution, pre-authorized access if roles are later granted, and information disclosure about project existence.\n\nThis change adds a shared check to verify the user has at least one role in the target project before allowing EC2 credential creation through either the OS-EC2 user credential API or the generic /v3/credentials API. Inaccessible existing projects are reported as ProjectNotFound so the response matches the missing-project case.\n\nThis mirrors the validation already performed during EC2 token authentication in keystone/api/_shared/EC2_S3_Resource.py.\n\nCloses-Bug: #2138298\n\nRelated-Bug: #2138295\n\nChange-Id: I09efc83d17ebc439f33bdd8d3c9d6adabd19db02\n\nChange-Id: Ib9816edd9780b91ffdccb117716d800d00b4c880\nSigned-off-by: Dong Ma \u003cwinterma.dong@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8e3143270f326a7ebb2bfe623683a6705f7c46bd"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8e3143270f326a7ebb2bfe623683a6705f7c46bd"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}