Inability to deny STS requests on a per user or instance basis

NOTE

If this case is urgent, please subscribe to Subnet so that our 24/7 support team may help you faster.

Over the weekend, one of our authenticated users generated millions of STS requests bringing down the MinIO cluster.

No errors shown in the logs. I needed to look into the file system to realize .minio.sys/config/iam/sts has millions of directories.

Based on conversations with @ravindk89 and @prakashsvmx, it is clear there is no way to stop STS requests on a per user basis or for the whole instance through either policies or mc command line.

Policy

{ "Version": "2012-10-17", "Statement": [ { "Action": [ "sts:AssumeRole" ], "Effect": "Deny", "Resource": [ "arn:aws:s3:::*" ], "Sid": "example" } ] }

Expected Behavior

Provide a way to deny STS requests

Current Behavior

No way to deny STS requests

Possible Solution

Steps to Reproduce (for bugs)

1. Create a user
2. Generate millions of STS requests
3. Notice MinIO not showing any errors in the logs
4. Randomly, user requests starts failing with access denied

Context

Regression

Your Environment

• Version used (minio --version):
• Server setup and configuration:
• Operating System and version (uname -a):