jenkinsci / jenkinsci/aws-credentials-plugin

Credential validity check does not work for credentials-admin

Open
#308 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
30
Forks
81
PR merge metrics
No merged PRs in 30d

Description

### Jenkins and plugins versions report

n/a

### What Operating System are you using (both controller, and any agents involved in the problem)?

n/a

### Reproduction steps

https://github.com/jenkinsci/aws-credentials-plugin/blob/5aec8d32b4c7f32cd3a4e39946290eed53e4edf7/src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AWSCredentialsImpl.java#L370-L373

I have the credentials-admin role on our CloudBees controller. However, because of this overly restrictive check, I can no longer rely on this plugin to verify that the AWS credentials I am configuring are correct before saving them. This makes credential rotation risky.

### Expected Results

Anyone who can set the credentials ought to be able to test their validity.

### Actual Results

The check no longer happens for credentials-admin.

### Anything else?

_No response_

### Are you interested in contributing a fix?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AWSCredentialsImpl.java around lines 370-373 and inspect the credential validity check and its permission condition. Trace the related tests or plugin test suite to understand the existing behavior. Done means credentials-admin users can test configured AWS credentials before saving, without weakening access controls.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
authorization, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.