refactor(blobmanager/s3accesspoint): tighten SessionPolicyARN validation

Replace the loose prefix-and-substring check with a proper arn.Parse
plus service and resource-type assertions, so configuration mistakes
that previously slipped through (role ARN whose path embeds
":policy/", policy ARN with an empty name, malformed ARNs) are now
rejected at credential-load time instead of surfacing as opaque STS
errors during upload.

Adds AWS-managed-policy ARNs (arn:aws:iam::aws:policy/...) to the
accepted set and locks down the previously-permissive shapes with
table-driven test cases.

Assisted-by: Claude
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: ee4385fa-8011-4750-87cd-502097dda8b9

Author: jiparis

pkg/blobmanager/s3accesspoint/provider.go

@@ -56,6 +56,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/aws/aws-sdk-go-v2/aws/arn"
 	backend "github.com/chainloop-dev/chainloop/pkg/blobmanager"
 	"github.com/chainloop-dev/chainloop/pkg/credentials"
 )
@@ -152,12 +153,18 @@ func (c *Credentials) Validate() error {
 			return fmt.Errorf("%w: base_role_arn %q is not a valid IAM role ARN", backend.ErrValidation, c.BaseRoleARN)
 		}
 	}
-	// SessionPolicyARN is optional. When set it must look like a managed
-	// IAM policy ARN — anything else (an S3 ARN, a role ARN) would be
-	// silently rejected by STS at request time, surfacing as opaque
-	// errors deep in the upload path. Fail loudly here instead.
+	// SessionPolicyARN is optional. When set it must be a syntactically
+	// valid IAM managed policy ARN — anything else (an S3 ARN, a role
+	// ARN, a policy ARN with no name, a role ARN that happens to embed
+	// ":policy/" in its path) would be silently rejected by STS at
+	// request time, surfacing as opaque errors deep in the upload path.
+	// Fail loudly here instead.
 	if c.SessionPolicyARN != "" {
-		if !strings.HasPrefix(c.SessionPolicyARN, "arn:aws:iam::") || !strings.Contains(c.SessionPolicyARN, ":policy/") {
+		a, err := arn.Parse(c.SessionPolicyARN)
+		if err != nil ||
+			a.Service != "iam" ||
+			!strings.HasPrefix(a.Resource, "policy/") ||
+			a.Resource == "policy/" {
 			return fmt.Errorf("%w: session_policy_arn %q is not a valid IAM managed policy ARN", backend.ErrValidation, c.SessionPolicyARN)
 		}
 	}

pkg/blobmanager/s3accesspoint/provider_test.go

@@ -92,6 +92,33 @@ func TestCredentials_Validate(t *testing.T) {
 			mutate:  func(c *Credentials) { c.SessionPolicyARN = "not-an-arn-at-all" },
 			wantErr: "not a valid IAM managed policy ARN",
 		},
+		{
+			name:    "session policy arn for AWS-managed policy accepted",
+			mutate:  func(c *Credentials) { c.SessionPolicyARN = "arn:aws:iam::aws:policy/AdministratorAccess" },
+			wantErr: "",
+		},
+		{
+			// previously the loose substring check would accept this because
+			// the string both starts with arn:aws:iam:: and contains :policy/
+			name:    "session policy arn embedded in role path rejected",
+			mutate:  func(c *Credentials) { c.SessionPolicyARN = "arn:aws:iam::123456789012:role/foo:policy/bar" },
+			wantErr: "not a valid IAM managed policy ARN",
+		},
+		{
+			name:    "session policy arn with empty name rejected",
+			mutate:  func(c *Credentials) { c.SessionPolicyARN = "arn:aws:iam::123456789012:policy/" },
+			wantErr: "not a valid IAM managed policy ARN",
+		},
+		{
+			name:    "session policy arn missing service rejected",
+			mutate:  func(c *Credentials) { c.SessionPolicyARN = "arn:aws::us-east-1:123456789012:policy/foo" },
+			wantErr: "not a valid IAM managed policy ARN",
+		},
+		{
+			name:    "session policy arn structurally malformed rejected",
+			mutate:  func(c *Credentials) { c.SessionPolicyARN = "arn:aws:iam" },
+			wantErr: "not a valid IAM managed policy ARN",
+		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {