Merge remote-tracking branch 'origin/hugo-cred-rotation' into test-delete-cred-rotation

feat(plugin): implement DeleteObjects functionality along with associated automated tests
feat(plugin): Implement Credential Rotation
2024-03-27 12:31:25 -04:00 · 2024-03-26 00:19:01 -04:00 · 2024-03-22 15:20:11 +00:00 · 2024-03-22 15:18:35 +00:00 · 2024-03-22 15:17:40 +00:00
9 changed files with 361 additions and 686 deletions
@@ -1,18 +1,17 @@
 module github.com/hashicorp/boundary-plugin-minio

-go 1.22.2
+go 1.21.5

 require (
 	github.com/google/go-cmp v0.6.0
 	github.com/google/uuid v1.5.0
-	github.com/hashicorp/boundary/sdk v0.0.43-0.20240717182311-a20aae98794a
-	github.com/hashicorp/go-multierror v1.1.1
+	github.com/hashicorp/boundary/sdk v0.0.42
 	github.com/minio/madmin-go/v3 v3.0.48
 	github.com/minio/minio-go/v7 v7.0.67
 	github.com/ory/dockertest/v3 v3.10.0
 	github.com/stretchr/testify v1.8.4
-	google.golang.org/grpc v1.61.0
-	google.golang.org/protobuf v1.33.0
+	google.golang.org/grpc v1.59.0
+	google.golang.org/protobuf v1.32.0
 )

 require (
@@ -23,7 +22,7 @@ require (
 	github.com/containerd/continuity v0.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/cli v20.10.17+incompatible // indirect
-	github.com/docker/docker v24.0.9+incompatible // indirect
+	github.com/docker/docker v20.10.7+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
@@ -36,6 +35,7 @@ require (
 	github.com/hashicorp/eventlogger v0.2.6-0.20231025104552-802587e608f0 // indirect
 	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 // indirect
 	github.com/hashicorp/go-kms-wrapping/v2 v2.0.14 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/imdario/mergo v0.3.13 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
@@ -54,7 +54,7 @@ require (
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runc v1.1.12 // indirect
+	github.com/opencontainers/runc v1.1.5 // indirect
 	github.com/philhofer/fwd v1.1.2 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
@@ -76,16 +76,14 @@ require (
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.3 // indirect
-	golang.org/x/crypto v0.22.0 // indirect
+	golang.org/x/crypto v0.17.0 // indirect
 	golang.org/x/mod v0.9.0 // indirect
-	golang.org/x/net v0.24.0 // indirect
-	golang.org/x/sync v0.5.0 // indirect
-	golang.org/x/sys v0.19.0 // indirect
+	golang.org/x/net v0.19.0 // indirect
+	golang.org/x/sync v0.3.0 // indirect
+	golang.org/x/sys v0.15.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/tools v0.7.0 // indirect
-	google.golang.org/genproto v0.0.0-20240116215550-a9fa1716bcac // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
@@ -1,5 +1,6 @@
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 h1:w+iIsaOQNcT7OZ575w+acHgRric5iCyQh+xv+KJ4HB8=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
@@ -16,18 +17,24 @@ github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQ
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/cenkalti/backoff/v4 v4.1.3 h1:cFAlzYUlVYDysBEH2T5hyJZMh3+5+WCBvSnK6Q8UtC4=
 github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
+github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
+github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
+github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
 github.com/containerd/continuity v0.3.0 h1:nisirsYROK15TAMVukJOUyGJjz4BNQJBVsNvAXZJ/eg=
 github.com/containerd/continuity v0.3.0/go.mod h1:wJEAIwKOm/pBZuBd0JmeTvnLquTB1Ag8espWhkykbPM=
+github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw=
 github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/docker/cli v20.10.17+incompatible h1:eO2KS7ZFeov5UJeaDmIs1NFEDRf32PaqRpvoEkKBy5M=
 github.com/docker/cli v20.10.17+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v24.0.9+incompatible h1:HPGzNmwfLZWdxHqK9/II92pyi1EpYKsAqcl4G0Of9v0=
-github.com/docker/docker v24.0.9+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v20.10.7+incompatible h1:Z6O9Nhsjv+ayUEeI1IojKbYcsGdgYSNqxe1s2MYzUhQ=
+github.com/docker/docker v20.10.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw=
@@ -36,12 +43,15 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
 github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
+github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-test/deep v1.0.4 h1:u2CU3YKy9I2pmu9pX0eq50wCgjfGIt539SqR7FbHiho=
 github.com/go-test/deep v1.0.4/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
@@ -63,8 +73,8 @@ github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaU
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
 github.com/google/uuid v1.5.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/boundary/sdk v0.0.43-0.20240717182311-a20aae98794a h1:SwVze6sYE5o+J9qdcgj29auY1k6O8oSo9DC2+2Gb9rw=
-github.com/hashicorp/boundary/sdk v0.0.43-0.20240717182311-a20aae98794a/go.mod h1:9iOT7kDM6mYcSkKxNuZlv8rP7U5BG1kXoevjLLL8lNQ=
+github.com/hashicorp/boundary/sdk v0.0.42 h1:iRDdnM6/6q9qLtBP7/cpq/FWQGf69TFSsBQFxgGK8Jw=
+github.com/hashicorp/boundary/sdk v0.0.42/go.mod h1:QJhm4rky2YMtk9DS5Rj8QJhDKB/6zQbVrm3R0QgdYmQ=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -126,8 +136,9 @@ github.com/klauspost/cpuid/v2 v2.2.6 h1:ndNyv040zDGIDh8thGkXYjnFtiN02M1PVVF+JE/4
 github.com/klauspost/cpuid/v2 v2.2.6/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -164,6 +175,7 @@ github.com/mitchellh/pointerstructure v1.2.1 h1:ZhBBeX8tSlRpu/FFhXH4RC4OJzFlqsQh
 github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moby/sys/mountinfo v0.5.0/go.mod h1:3bMD3Rg+zkqx8MRYPi7Pyb0Ie97QEBmdxbhnCLlSvSU=
 github.com/moby/term v0.0.0-20201216013528-df9cb8a40635 h1:rzf0wL0CHVc8CEsgyygG0Mn9CNCCPZqOPaz8RiiHYQk=
 github.com/moby/term v0.0.0-20201216013528-df9cb8a40635/go.mod h1:FBS0z0QWA44HXygs7VXDUOGoN/1TV3RuWkLO04am3wc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -171,14 +183,17 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM=
 github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/runc v1.1.12 h1:BOIssBaW1La0/qbNZHXOOa71dZfZEQOzW7dqQf3phss=
-github.com/opencontainers/runc v1.1.12/go.mod h1:S+lQwSfncpBha7XTy/5lBwWgm5+y5Ma/O44Ekby9FK8=
+github.com/opencontainers/runc v1.1.5 h1:L44KXEpKmfWDcS02aeGm8QNTFXTo2D+8MYGDIJ/GDEs=
+github.com/opencontainers/runc v1.1.5/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg=
+github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
 github.com/ory/dockertest/v3 v3.10.0 h1:4K3z2VMe8Woe++invjaTB7VRyQXQy5UY+loujO4aNE4=
 github.com/ory/dockertest/v3 v3.10.0/go.mod h1:nr57ZbRWMqfsdGdFNLHz5jjNdDb7VVFnzAeW1n5N1Lg=
 github.com/philhofer/fwd v1.1.2 h1:bnDivRJ1EWPjUIRXV5KfORO897HTbpFAQddBdE8t7Gw=
@@ -207,10 +222,12 @@ github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjR
 github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc=
 github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/safchain/ethtool v0.3.0 h1:gimQJpsI6sc1yIqP/y8GYgiXn/NjgvpM0RNoWLVVmP0=
 github.com/safchain/ethtool v0.3.0/go.mod h1:SA9BwrgyAqNo7M+uaL6IYbxpm5wk3L7Mm6ocLW+CJUs=
+github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
 github.com/secure-io/sio-go v0.3.1 h1:dNvY9awjabXTYGsTF1PiCySl9Ltofk9GA3VdWlo7rRc=
 github.com/secure-io/sio-go v0.3.1/go.mod h1:+xbkjDzPjwh4Axd07pRKSNriS9SCiYksWnZqdnfpQxs=
 github.com/shirou/gopsutil/v3 v3.23.12 h1:z90NtUkp3bMtmICZKpC4+WaknU1eXtp5vtbQ11DgpE4=
@@ -221,6 +238,8 @@ github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
 github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
 github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
 github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
@@ -229,6 +248,7 @@ github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnIn
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -236,12 +256,16 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/tinylib/msgp v1.1.8 h1:FCXC1xanKO4I8plpHGH2P7koL/RzZs12l/+r7vakfm0=
 github.com/tinylib/msgp v1.1.8/go.mod h1:qkpG+2ldGg4xRFmx+jfTvZPxfGFhi64BcnL9vkCm/Tw=
 github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
 github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
+github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
+github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f h1:J9EGpcZtP0E/raorCMxlFGSTBrsSlaDGf3jU/qvAE2c=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
@@ -261,8 +285,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
-golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
+golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
@@ -278,28 +302,36 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
-golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
-golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
+golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -308,9 +340,8 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
-golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
@@ -337,18 +368,15 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto v0.0.0-20240116215550-a9fa1716bcac h1:ZL/Teoy/ZGnzyrqK/Optxxp2pmVh+fmJ97slxSRyzUg=
-google.golang.org/genproto v0.0.0-20240116215550-a9fa1716bcac/go.mod h1:+Rvu7ElI+aLzyDQhpHMFMMltsD6m7nqpuWDd2CwJw3k=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe h1:0poefMBYvYbs7g5UkjS6HcxBPaTRAmznle9jnxYoAI8=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:4jWUdICTdgc3Ibxmr8nAJiiLHwQBY0UI0XZcEMaFKaA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe h1:bQnxqljG/wqi4NTXu2+DJ3n7APcEA882QZ1JvhQAq9o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
-google.golang.org/grpc v1.61.0 h1:TOvOcuXn30kRao+gfcvsebNEa5iZIiLkisYEkf7R7o0=
-google.golang.org/grpc v1.61.0/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b h1:ZlWIi1wSK56/8hn4QcBp/j9M7Gt3U/3hZw3mC7vDICo=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:swOH3j0KzcDDgGUWr+SNpyTen5YrXjS3eyPzFYKc6lc=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
+google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -13,7 +13,6 @@ boundary storage-buckets create \
  -worker-filter '"minio-access" in "/tags/type"' \
  -attr endpoint_url="https://my-minio-instance.dev/s3-api" \
  -attr region=REGION \
-  -attr disable_credential_rotation=true \
  -secret access_key_id='KEY' \
  -secret secret_access_key='SECRET'
 ```
@@ -25,11 +24,6 @@ The following `attributes` are valid on a MinIO storage bucket resource:
 - `endpoint_url` (string, required): Fully-qualified endpoint pointing to a
  MinIO S3 API.
 - `region` (string, optional): The region to configure the storage bucket for.
- `disable_credential_rotation` (bool, optional): Controls whether the plugin
-  will rotate the incoming credentials and manage a new MinIO service account.
-  If this attribute is set to `false`, or not provided, the plugin will rotate
-  the incoming credentials, using them to create a new MinIO service account,
-  then delete the incoming credentials.

 ### Secrets

@@ -65,11 +65,11 @@ func (sa *StorageSecrets) AsMap() map[string]any {

 // Clone returns a new StorageSecrets object with the same state as the incoming
 // one.
-func (sec *StorageSecrets) Clone() *StorageSecrets {
+func (ss *StorageSecrets) Clone() *StorageSecrets {
 	return &StorageSecrets{
-		AccessKeyId:     sec.AccessKeyId,
-		SecretAccessKey: sec.SecretAccessKey,
-		LastRotatedTime: sec.LastRotatedTime,
+		AccessKeyId:     ss.AccessKeyId,
+		SecretAccessKey: ss.SecretAccessKey,
+		LastRotatedTime: ss.LastRotatedTime,
 	}
 }

@@ -333,9 +333,9 @@ func TestTestStorageSecretsClone(t *testing.T) {
 		LastRotatedTime: now,
 	}

-	secCl := in.Clone()
-	require.Equal(t, in.AccessKeyId, secCl.AccessKeyId)
-	require.Equal(t, in.AccessKeyId, secCl.AccessKeyId)
-	require.Equal(t, in.LastRotatedTime, secCl.LastRotatedTime)
-	require.NotSame(t, in, secCl)
+	ss := in.Clone()
+	require.Equal(t, in.AccessKeyId, ss.AccessKeyId)
+	require.Equal(t, in.AccessKeyId, ss.AccessKeyId)
+	require.Equal(t, in.LastRotatedTime, ss.LastRotatedTime)
+	require.NotSame(t, in, ss)
 }
@@ -19,7 +19,6 @@ import (
 	"github.com/google/uuid"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/storagebuckets"
 	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
-	"github.com/hashicorp/go-multierror"
 	madmin "github.com/minio/madmin-go/v3"
 	"github.com/minio/minio-go/v7"
 	"github.com/minio/minio-go/v7/pkg/credentials"
@@ -61,6 +60,11 @@ func (sp *StoragePlugin) OnCreateStorageBucket(ctx context.Context, req *pb.OnCr
 		return nil, err
 	}

+	err = ensureServiceAccount(ctx, sa, sec)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "failed to ensure service account: %v", err)
+	}
+
 	deleteOldCredsFn := func() error { return nil }
 	if !sa.DisableCredentialRotation {
 		newSec, fn, err := rotateCredentials(ctx, bucket.GetBucketName(), sa, sec)
@@ -80,15 +84,9 @@ func (sp *StoragePlugin) OnCreateStorageBucket(ctx context.Context, req *pb.OnCr
 		return nil, status.Errorf(codes.Unknown, "failed to create minio sdk client: %v", err)
 	}

-	p, dryRunErr := dryRun(ctx, cl, bucket)
-	if dryRunErr.Len() > 0 {
-		st := status.New(codes.InvalidArgument, fmt.Sprintf("failed to verify provided minio environment: %v", dryRunErr.Unwrap()))
-
-		st, err = st.WithDetails(&pb.StorageBucketCredentialState{State: p})
-		if err != nil {
-			st = status.New(codes.Unknown, fmt.Sprintf("failed to verify provided minio environment: %v", dryRunErr.Unwrap()))
-		}
-		return nil, st.Err()
+	err = dryRun(ctx, cl, bucket)
+	if err != nil {
+		return nil, status.Errorf(codes.Unknown, "failed to verify provided minio environment: %v", err)
 	}

 	persistedData, err := structpb.NewStruct(sec.AsMap())
@@ -180,17 +178,22 @@ func (sp *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUp
 			return nil, err
 		}

+		err = ensureServiceAccount(ctx, nsa, newSec)
+		if err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "failed to ensure service account: %s", err)
+		}
+
 		if !nsa.DisableCredentialRotation {
 			// We have new incoming credentials and we're also rotating,
 			// therefore we use incoming credentials to create a new service
 			// account, then delete the incoming credentials. The existing
 			// persisted credentials have already been scheduled for deletion
 			// above (if applicable), so we don't need to do it here.
-			rotatedSec, fn, err := rotateCredentials(ctx, newBucket.GetBucketName(), nsa, newSec)
+			ss, fn, err := rotateCredentials(ctx, newBucket.GetBucketName(), nsa, newSec)
 			if err != nil {
 				return nil, status.Errorf(codes.InvalidArgument, "failed to rotate minio credentials: %v", err)
 			}
-			sec = rotatedSec
+			sec = ss
 			deleteRotatedCredsFn = fn
 		} else {
 			// We have new incoming credentials but we're not rotating. Set them
@@ -202,8 +205,16 @@ func (sp *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUp
 	} else {
 		if osa.DisableCredentialRotation && !nsa.DisableCredentialRotation {
 			// Handle the case where the user enables credential rotation but
-			// provides no new credentials. This is an error.
-			return nil, status.Errorf(codes.InvalidArgument, "credential rotation enabled with no new credentials provided")
+			// provides no new credentials. In this case, we use the existing
+			// persisted credentials to generate a new service account. The
+			// persisted credentials are, by definition, not being managed by us
+			// (credential rotation was disabled beforehand), so don't schedule
+			// them for deletion.
+			ss, _, err := rotateCredentials(ctx, newBucket.GetBucketName(), nsa, sec)
+			if err != nil {
+				return nil, status.Errorf(codes.InvalidArgument, "failed to rotate minio credentials: %v", err)
+			}
+			sec = ss
 		}
 	}

@@ -216,16 +227,8 @@ func (sp *StoragePlugin) OnUpdateStorageBucket(ctx context.Context, req *pb.OnUp
 		return nil, status.Errorf(codes.InvalidArgument, "failed to create minio sdk client: %s", err)
 	}

-	if p, dryRunErr := dryRun(ctx, cl, newBucket); dryRunErr != nil {
-		if dryRunErr.Len() > 0 {
-			st := status.New(codes.InvalidArgument, fmt.Sprintf("failed to verify provided minio environment: %v", dryRunErr.Unwrap()))
-
-			st, err = st.WithDetails(&pb.StorageBucketCredentialState{State: p})
-			if err != nil {
-				st = status.New(codes.InvalidArgument, fmt.Sprintf("failed to verify provided minio environment: %v", dryRunErr.Unwrap()))
-			}
-			return nil, st.Err()
-		}
+	if err = dryRun(ctx, cl, newBucket); err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "failed to verify provided minio environment: %s", err)
 	}

 	persisted, err := structpb.NewStruct(sec.AsMap())
@@ -297,13 +300,9 @@ func (sp *StoragePlugin) ValidatePermissions(ctx context.Context, req *pb.Valida
 		return nil, err
 	}

-	if !sec.LastRotatedTime.IsZero() {
-		// since these are existing secrets, we only want to validate the
-		// service account if the credentials have been rotated previously
-		err = ensureServiceAccount(ctx, sa, sec)
-		if err != nil {
-			return nil, status.Errorf(codes.InvalidArgument, "failed to ensure service account: %v", err)
-		}
+	err = ensureServiceAccount(ctx, sa, sec)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "failed to ensure service account: %v", err)
 	}

 	cl, err := minio.New(sa.EndpointUrl, &minio.Options{
@@ -315,15 +314,9 @@ func (sp *StoragePlugin) ValidatePermissions(ctx context.Context, req *pb.Valida
 		return nil, status.Errorf(codes.Unknown, "failed to create minio sdk client: %v", err)
 	}

-	p, dryRunErr := dryRun(ctx, cl, bucket)
-	if dryRunErr.Unwrap() != nil {
-		st := status.New(codes.FailedPrecondition, fmt.Sprintf("failed to verify provided minio environment: %v", dryRunErr.Unwrap()))
-
-		st, err = st.WithDetails(&pb.StorageBucketCredentialState{State: p})
-		if err != nil {
-			st = status.New(codes.Unknown, fmt.Sprintf("failed to verify provided minio environment: %v", dryRunErr.Unwrap()))
-		}
-		return nil, st.Err()
+	err = dryRun(ctx, cl, bucket)
+	if err != nil {
+		return nil, status.Errorf(codes.Unknown, "failed to verify provided minio environment: %v", err)
 	}

 	return &pb.ValidatePermissionsResponse{}, nil
@@ -359,13 +352,13 @@ func (sp *StoragePlugin) HeadObject(ctx context.Context, req *pb.HeadObjectReque
 		Region: sa.Region,
 	})
 	if err != nil {
-		return nil, errorToStatus(codes.Unknown, fmt.Sprintf("failed to create minio sdk client: %v", err), err, req).Err()
+		return nil, status.Errorf(codes.Unknown, "failed to create minio sdk client: %v", err)
 	}

 	objKey := path.Join(bucket.GetBucketPrefix(), req.GetKey())
 	oi, err := cl.StatObject(ctx, bucket.GetBucketName(), objKey, minio.StatObjectOptions{})
 	if err != nil {
-		return nil, errorToStatus(codes.Unknown, fmt.Sprintf("failed to stat object: %v", err), err, req).Err()
+		return nil, status.Errorf(codes.Unknown, "failed to stat object: %v", err)
 	}

 	return &pb.HeadObjectResponse{
@@ -404,13 +397,13 @@ func (sp *StoragePlugin) GetObject(req *pb.GetObjectRequest, objServer pb.Storag
 		Region: sa.Region,
 	})
 	if err != nil {
-		return errorToStatus(codes.Unknown, fmt.Sprintf("failed to create minio sdk client: %v", err), err, req).Err()
+		return status.Errorf(codes.Unknown, "failed to create minio sdk client: %v", err)
 	}

 	objKey := path.Join(bucket.GetBucketPrefix(), req.GetKey())
 	obj, err := cl.GetObject(objServer.Context(), bucket.GetBucketName(), objKey, minio.GetObjectOptions{})
 	if err != nil {
-		return errorToStatus(codes.Unknown, fmt.Sprintf("failed to get object: %v", err), err, req).Err()
+		return status.Errorf(codes.Unknown, "failed to get object: %v", err)
 	}
 	defer obj.Close()

@@ -493,7 +486,7 @@ func (sp *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest
 		Region: sa.Region,
 	})
 	if err != nil {
-		return nil, errorToStatus(codes.Internal, fmt.Sprintf("failed to create minio sdk client: %v", err), err, req).Err()
+		return nil, status.Errorf(codes.Internal, "failed to create minio sdk client: %v", err)
 	}

 	hash := sha256.New()
@@ -512,24 +505,18 @@ func (sp *StoragePlugin) PutObject(ctx context.Context, req *pb.PutObjectRequest
 			"x-amz-checksum-algorithm": "SHA256",
 			"x-amz-checksum-sha256":    checksum,
 		},
-		DisableMultipart: true,
 	})
 	if err != nil {
-		return nil, errorToStatus(codes.Internal, fmt.Sprintf("failed to put object into minio: %v", err), err, req).Err()
+		return nil, status.Errorf(codes.Internal, "failed to put object into minio: %v", err)
 	}

-	resChecksum := res.ChecksumSHA256
-	if resChecksum == "" {
-		// We were successful in putting the object but we didn't get a file
-		// SHA256 checksum from the server. Given that the call was successful,
-		// assume everything went ok and force the checksum to match so we can
-		// send it correctly back to Boundary.
-		resChecksum = checksum
+	if res.ChecksumSHA256 == "" {
+		return nil, status.Error(codes.Internal, "missing checksum response from minio")
 	}
-	if checksum != resChecksum {
+	if checksum != res.ChecksumSHA256 {
 		return nil, status.Error(codes.Internal, "mismatched checksum")
 	}
-	decodedChecksum, err := base64.StdEncoding.DecodeString(resChecksum)
+	decodedChecksum, err := base64.StdEncoding.DecodeString(res.ChecksumSHA256)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "failed to decode checksum value from minio: %v", err)
 	}
@@ -569,7 +556,7 @@ func (sp *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObject
 		Region: sa.Region,
 	})
 	if err != nil {
-		return nil, errorToStatus(codes.Unknown, fmt.Sprintf("failed to create minio sdk client: %v", err), err, req).Err()
+		return nil, status.Errorf(codes.Unknown, "failed to create minio sdk client: %v", err)
 	}

 	prefix := path.Join(bucket.GetBucketPrefix(), req.GetKeyPrefix())
@@ -581,7 +568,7 @@ func (sp *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObject

 	if !req.Recursive {
 		if err := cl.RemoveObject(ctx, bucket.GetBucketName(), prefix, minio.RemoveObjectOptions{}); err != nil {
-			return nil, errorToStatus(codes.Unknown, fmt.Sprintf("error deleting minio object: %v", err), err, req).Err()
+			return nil, status.Errorf(codes.Unknown, "error deleting minio object: %v", err)
 		}
 		return &pb.DeleteObjectsResponse{
 			ObjectsDeleted: uint32(1),
@@ -594,7 +581,8 @@ func (sp *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObject
 		Recursive: true,
 	}) {
 		if obj.Err != nil {
-			return nil, errorToStatus(codes.Unknown, fmt.Sprintf("error iterating minio bucket contents: %v", obj.Err), obj.Err, req).Err()
+			// check if context cancelled ?
+			return nil, status.Errorf(codes.Unknown, "error iterating minio bucket contents: %v", err)
 		}
 		objects = append(objects, obj)
 	}
@@ -611,7 +599,8 @@ func (sp *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObject
 	removed := 0
 	for res := range cl.RemoveObjectsWithResult(ctx, bucket.GetBucketName(), emitter, minio.RemoveObjectsOptions{}) {
 		if res.Err != nil {
-			return nil, errorToStatus(codes.Unknown, fmt.Sprintf("error deleting minio object(s): %v", res.Err), res.Err, req).Err()
+			// check if context cancelled ?
+			return nil, status.Errorf(codes.Unknown, "error deleting minio object(s): %v", err)
 		}
 		removed++
 	}
@@ -621,145 +610,37 @@ func (sp *StoragePlugin) DeleteObjects(ctx context.Context, req *pb.DeleteObject
 	}, nil
 }

-// validateWritePermission checks if the plugin has write permission for an object.
-func validateWritePermission(ctx context.Context, cl *minio.Client, bucket *storagebuckets.StorageBucket, objectKey string) (*pb.Permission, *multierror.Error) {
-	const op = "storage.validateWritePermission"
-	var combinedErrors *multierror.Error
-
-	if cl == nil {
-		err := fmt.Errorf("%s: minio client is nil", op)
-		return &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: err.Error(), CheckedAt: timestamppb.Now()}, multierror.Append(combinedErrors, err)
-	}
-	if bucket == nil {
-		err := fmt.Errorf("%s: storage bucket is nil", op)
-		return &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: err.Error(), CheckedAt: timestamppb.Now()}, multierror.Append(combinedErrors, err)
-	}
-
+func dryRun(ctx context.Context, cl *minio.Client, bucket *storagebuckets.StorageBucket) error {
+	objectKey := path.Join(bucket.GetBucketPrefix(), uuid.New().String())
 	rd := bytes.NewReader([]byte("hashicorp boundary minio plugin access test"))
 	_, err := cl.PutObject(ctx, bucket.GetBucketName(), objectKey, rd, rd.Size(), minio.PutObjectOptions{})
 	if err != nil {
-		combinedErrors = multierror.Append(combinedErrors, fmt.Errorf("failed to put object at %q: %w", objectKey, err))
-		return errorToPermission(err), combinedErrors
+		return fmt.Errorf("failed to put object at %q: %w", objectKey, err)
 	}

-	return &pb.Permission{State: pb.StateType_STATE_TYPE_OK, CheckedAt: timestamppb.Now()}, nil
-}
-
-// validateReadPermission checks if the plugin has read permission for an object.
-func validateReadPermission(ctx context.Context, cl *minio.Client, bucket *storagebuckets.StorageBucket, objectKey string) (*pb.Permission, *multierror.Error) {
-	const op = "storage.validateReadPermission"
-	var combinedErrors *multierror.Error
-
-	if cl == nil {
-		err := fmt.Errorf("%s: minio client is nil", op)
-		return &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: err.Error(), CheckedAt: timestamppb.Now()}, multierror.Append(combinedErrors, err)
-	}
-	if bucket == nil {
-		err := fmt.Errorf("%s: storage bucket is nil", op)
-		return &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: err.Error(), CheckedAt: timestamppb.Now()}, multierror.Append(combinedErrors, err)
-	}
-	if objectKey == "" {
-		err := fmt.Errorf("%s: object key is empty", op)
-		return &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: err.Error(), CheckedAt: timestamppb.Now()}, multierror.Append(combinedErrors, err)
-	}
-
-	permission := &pb.Permission{State: pb.StateType_STATE_TYPE_OK}
-	_, err := cl.StatObject(ctx, bucket.GetBucketName(), objectKey, minio.StatObjectOptions{})
+	_, err = cl.StatObject(ctx, bucket.GetBucketName(), objectKey, minio.StatObjectOptions{})
 	if err != nil {
-		permission = errorToPermission(err)
-		combinedErrors = multierror.Append(combinedErrors, fmt.Errorf("failed to stat object at %q: %w", objectKey, err))
+		return fmt.Errorf("failed to stat object at %q: %w", objectKey, err)
 	}

 	_, err = cl.GetObject(ctx, bucket.GetBucketName(), objectKey, minio.GetObjectOptions{})
 	if err != nil {
-		p := errorToPermission(err)
-		if permission.GetState() == pb.StateType_STATE_TYPE_OK {
-			permission = p
-		} else {
-			if p != nil && p.GetErrorDetails() != "" {
-				permission.ErrorDetails = fmt.Sprintf("%s, %s", permission.GetErrorDetails(), p.GetErrorDetails())
-			}
-		}
-		combinedErrors = multierror.Append(combinedErrors, fmt.Errorf("failed to get object at %q: %w", objectKey, err))
+		return fmt.Errorf("failed to get object at %q: %w", objectKey, err)
 	}

 	oiCh := cl.ListObjects(ctx, bucket.GetBucketName(), minio.ListObjectsOptions{Recursive: true})
 	for oi := range oiCh {
 		if oi.Err != nil {
-			if permission.GetState() == pb.StateType_STATE_TYPE_OK {
-				permission = errorToPermission(oi.Err)
-			} else {
-				p := errorToPermission(err)
-				if p != nil && p.GetErrorDetails() != "" {
-					permission.ErrorDetails = fmt.Sprintf("%s, %s", permission.GetErrorDetails(), p.GetErrorDetails())
-				}
-			}
-			combinedErrors = multierror.Append(fmt.Errorf("failed to list objects in bucket %q: %w", bucket.GetBucketName(), oi.Err))
+			return fmt.Errorf("failed to list objects in bucket %q: %w", bucket.GetBucketName(), oi.Err)
 		}
 	}

-	if combinedErrors != nil {
-		return permission, combinedErrors
-	}
-
-	permission.CheckedAt = timestamppb.Now()
-	return permission, nil
-}
-
-// validateDeletePermission checks if the plugin has delete permission for an object.
-func validateDeletePermission(ctx context.Context, cl *minio.Client, bucket *storagebuckets.StorageBucket, objectKey string) (*pb.Permission, *multierror.Error) {
-	const op = "storage.validateDeletePermission"
-
-	var combinedErrors *multierror.Error
-
-	if cl == nil {
-		err := fmt.Errorf("%s: minio client is nil", op)
-		combinedErrors = multierror.Append(combinedErrors, err)
-		return &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: err.Error(), CheckedAt: timestamppb.Now()}, combinedErrors
-	}
-	if bucket == nil {
-		err := fmt.Errorf("%s: storage bucket is nil", op)
-		combinedErrors = multierror.Append(combinedErrors, err)
-		return &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: err.Error(), CheckedAt: timestamppb.Now()}, combinedErrors
-	}
-	if objectKey == "" {
-		err := fmt.Errorf("%s: object key is empty", op)
-		combinedErrors = multierror.Append(combinedErrors, err)
-		return &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: err.Error(), CheckedAt: timestamppb.Now()}, combinedErrors
-	}
-
-	err := cl.RemoveObject(ctx, bucket.GetBucketName(), objectKey, minio.RemoveObjectOptions{})
+	err = cl.RemoveObject(ctx, bucket.GetBucketName(), objectKey, minio.RemoveObjectOptions{})
 	if err != nil {
-		combinedErrors = multierror.Append(combinedErrors, fmt.Errorf("failed to remove object at %q: %w", objectKey, err))
-		return errorToPermission(err), combinedErrors
+		return fmt.Errorf("failed to remove object at %q: %w", objectKey, err)
 	}

-	return &pb.Permission{State: pb.StateType_STATE_TYPE_OK, CheckedAt: timestamppb.Now()}, nil
-}
-
-func dryRun(ctx context.Context, cl *minio.Client, bucket *storagebuckets.StorageBucket) (*pb.Permissions, *multierror.Error) {
-	objectKey := path.Join(bucket.GetBucketPrefix(), uuid.New().String())
-	permissions := &pb.Permissions{
-		Write:  &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, CheckedAt: timestamppb.Now()},
-		Read:   &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, CheckedAt: timestamppb.Now()},
-		Delete: &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, CheckedAt: timestamppb.Now()},
-	}
-
-	var combinedErrors *multierror.Error
-
-	writePermission, writeErr := validateWritePermission(ctx, cl, bucket, objectKey)
-	combinedErrors = multierror.Append(combinedErrors, writeErr)
-	permissions.Write = writePermission
-
-	readPermission, readErr := validateReadPermission(ctx, cl, bucket, objectKey)
-	combinedErrors = multierror.Append(combinedErrors, readErr)
-	permissions.Read = readPermission
-
-	deletePermission, deleteErr := validateDeletePermission(ctx, cl, bucket, objectKey)
-	combinedErrors = multierror.Append(combinedErrors, deleteErr)
-	permissions.Delete = deletePermission
-
-	return permissions, combinedErrors
+	return nil
 }

 func newMadminClient(sa *StorageAttributes, sec *StorageSecrets) (*madmin.AdminClient, error) {
@@ -784,82 +665,3 @@ func ensureServiceAccount(ctx context.Context, sa *StorageAttributes, sec *Stora

 	return nil
 }
-
-// errorToPermission converts a MinIO error to a plugin permission.
-// errorToPermission only handles a subset of MinIO errors that have to do with
-// permissions.
-// If the MinIO error is not recognized, it returns a permission with an unknown state.
-func errorToPermission(err error) *pb.Permission {
-	if err == nil {
-		return &pb.Permission{}
-	}
-
-	errResponse := minio.ToErrorResponse(err)
-	switch errResponse.Code {
-	// https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList
-	case "AccessDenied":
-		fallthrough
-	case "InvalidSecurity":
-		fallthrough
-	case "InvalidAccessKeyId":
-		fallthrough
-	case "NoSuchBucket":
-		return &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: errResponse.Error(), CheckedAt: timestamppb.Now()}
-	case "InvalidObjectState":
-		fallthrough
-	default:
-		return &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: errResponse.Error(), CheckedAt: timestamppb.Now()}
-	}
-}
-
-// errorToStatus converts an error to a gRPC status with the plugin permission
-// attached.
-// If the permission error is not recognized, a gRPC status will be returned
-// with an code and error message passed in.
-func errorToStatus(code codes.Code, msg string, err error, req any) *status.Status {
-	errResponse := minio.ToErrorResponse(err)
-	switch errResponse.Code {
-	// https://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html#ErrorCodeList
-	case "RequestTimeout":
-		return status.New(codes.DeadlineExceeded, "timeout exceeded when communicating with storage service provider")
-	case "SlowDown":
-		return status.New(codes.Unavailable, "received a throttling response from storage service provider")
-	case "BadDigest":
-		return status.New(codes.Aborted, "storage checksum mismatch")
-	case "NoSuchBucket":
-		return status.New(codes.NotFound, "specified storage bucket does not exist")
-	case "NoSuchKey":
-		return status.New(codes.NotFound, "specified object does not exist")
-	}
-	if errResponse.StatusCode == 400 {
-		// catch-all for various different bad-request related errors
-		return status.New(codes.InvalidArgument, "received a bad request response from storage service provider")
-	}
-
-	// for all other errors, we can parse as permission state errors
-
-	st := status.New(code, msg)
-	if err == nil {
-		return st
-	}
-	permission := errorToPermission(err)
-	state := &pb.StorageBucketCredentialState{State: &pb.Permissions{}}
-
-	// we can use the request type to determine what kind of response we should return
-	switch req.(type) {
-	case pb.HeadObjectRequest:
-		state.State.Read = permission
-	case pb.GetObjectRequest:
-		state.State.Read = permission
-	case pb.PutObjectRequest:
-		state.State.Write = permission
-	case pb.DeleteObjectsRequest:
-		state.State.Delete = permission
-	}
-
-	st, err = st.WithDetails(state)
-	if err != nil {
-		st = status.New(code, msg)
-	}
-	return st
-}
@@ -7,7 +7,6 @@ import (
 	"bufio"
 	"bytes"
 	"context"
-	"crypto/rand"
 	"crypto/sha256"
 	"encoding/json"
 	"fmt"
@@ -192,12 +191,11 @@ func TestOnCreateStorageBucket(t *testing.T) {
 	require.NoError(t, err)

 	tests := []struct {
-		name                string
-		req                 *plugin.OnCreateStorageBucketRequest
-		expRsp              *plugin.OnCreateStorageBucketResponse
-		expCredRotation     bool
-		expErrMsg           string
-		expectedPermissions *pb.Permissions
+		name            string
+		req             *plugin.OnCreateStorageBucketRequest
+		expRsp          *plugin.OnCreateStorageBucketResponse
+		expCredRotation bool
+		expErrMsg       string
 	}{
 		{
 			name:      "nilBucket",
@@ -236,6 +234,26 @@ func TestOnCreateStorageBucket(t *testing.T) {
 			},
 			expErrMsg: "empty secrets input",
 		},
+		{
+			name: "usingNonServiceAccount",
+			req: &plugin.OnCreateStorageBucketRequest{
+				Bucket: &storagebuckets.StorageBucket{
+					BucketName: bucketName,
+					Attributes: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							ConstEndpointUrl: structpb.NewStringValue("http://" + server.ApiAddr),
+						},
+					},
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
+							ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
+						},
+					},
+				},
+			},
+			expErrMsg: "The specified service account is not found (Specified service account does not exist)",
+		},
 		{
 			name: "dryRunFail",
 			req: &plugin.OnCreateStorageBucketRequest{
@@ -263,11 +281,6 @@ func TestOnCreateStorageBucket(t *testing.T) {
 				},
 			},
 			expErrMsg: "failed to verify provided minio environment: failed to put object",
-			expectedPermissions: &pb.Permissions{
-				Write:  &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "Access Denied."},
-				Read:   &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: "The specified key does not exist."},
-				Delete: &pb.Permission{State: pb.StateType_STATE_TYPE_OK, ErrorDetails: ""},
-			},
 		},
 		{
 			name: "credRotationFail",
@@ -310,59 +323,6 @@ func TestOnCreateStorageBucket(t *testing.T) {
 			}(),
 			expErrMsg: "failed to rotate minio credentials: failed to create new minio service account: Access Denied",
 		},
-		{
-			name: "credRotationFailNoSvcAcct",
-			req: func() *plugin.OnCreateStorageBucketRequest {
-				return &plugin.OnCreateStorageBucketRequest{
-					Bucket: &storagebuckets.StorageBucket{
-						BucketName: bucketName,
-						Attributes: &structpb.Struct{
-							Fields: map[string]*structpb.Value{
-								ConstEndpointUrl:               structpb.NewStringValue("http://" + server.ApiAddr),
-								ConstDisableCredentialRotation: structpb.NewBoolValue(false),
-							},
-						},
-						Secrets: &structpb.Struct{
-							Fields: map[string]*structpb.Value{
-								ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
-								ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
-							},
-						},
-					},
-				}
-			}(),
-			expErrMsg: "The specified service account is not found (Specified service account does not exist)",
-		},
-		{
-			name: "successNonServiceAccount",
-			req: &plugin.OnCreateStorageBucketRequest{
-				Bucket: &storagebuckets.StorageBucket{
-					BucketName: bucketName,
-					Attributes: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstEndpointUrl:               structpb.NewStringValue("http://" + server.ApiAddr),
-							ConstDisableCredentialRotation: structpb.NewBoolValue(true),
-						},
-					},
-					Secrets: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
-							ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
-						},
-					},
-				},
-			},
-			expRsp: &plugin.OnCreateStorageBucketResponse{
-				Persisted: &storagebuckets.StorageBucketPersisted{
-					Data: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
-							ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
-						},
-					},
-				},
-			},
-		},
 		{
 			name: "successNoRotation",
 			req: &plugin.OnCreateStorageBucketRequest{
@@ -437,28 +397,6 @@ func TestOnCreateStorageBucket(t *testing.T) {
 			if tt.expErrMsg != "" {
 				require.ErrorContains(t, err, tt.expErrMsg)
 				require.Nil(t, rsp)
-
-				// Check the permission error.
-				if tt.expectedPermissions != nil {
-					st, ok := status.FromError(err)
-					require.True(t, ok)
-					var permission *pb.StorageBucketCredentialState
-					for _, detail := range st.Details() {
-						if errDetail, ok := detail.(*pb.StorageBucketCredentialState); ok {
-							permission = errDetail
-							break
-						}
-					}
-					require.NotNil(t, permission)
-
-					assert.Equal(t, tt.expectedPermissions.GetWrite().GetState(), permission.GetState().GetWrite().GetState())
-					assert.Equal(t, tt.expectedPermissions.GetRead().GetState(), permission.GetState().GetRead().GetState())
-					assert.Equal(t, tt.expectedPermissions.GetDelete().GetState(), permission.GetState().GetDelete().GetState())
-
-					assert.Contains(t, tt.expectedPermissions.GetWrite().GetErrorDetails(), permission.GetState().GetWrite().GetErrorDetails())
-					assert.Contains(t, tt.expectedPermissions.GetRead().GetErrorDetails(), permission.GetState().GetRead().GetErrorDetails())
-					assert.Contains(t, tt.expectedPermissions.GetDelete().GetErrorDetails(), permission.GetState().GetDelete().GetErrorDetails())
-				}
 				return
 			}

@@ -509,12 +447,11 @@ func TestOnUpdateStorageBucket(t *testing.T) {
 	require.NoError(t, server.Client.MakeBucket(ctx, bucketName, minio.MakeBucketOptions{}))

 	tests := []struct {
-		name                string
-		req                 *plugin.OnUpdateStorageBucketRequest
-		expected            *plugin.OnUpdateStorageBucketResponse
-		err                 string
-		expectedPermissions *pb.Permissions
-		errCode             codes.Code
+		name     string
+		req      *plugin.OnUpdateStorageBucketRequest
+		expected *plugin.OnUpdateStorageBucketResponse
+		err      string
+		errCode  codes.Code
 	}{
 		{
 			name:    "nilNewBucket",
@@ -827,6 +764,43 @@ func TestOnUpdateStorageBucket(t *testing.T) {
 			err:     "cannot disable rotation for already-rotated credentials",
 			errCode: codes.InvalidArgument,
 		},
+		{
+			name: "usingNonServiceAccount",
+			req: &plugin.OnUpdateStorageBucketRequest{
+				NewBucket: &storagebuckets.StorageBucket{
+					BucketName: bucketName,
+					Attributes: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							ConstEndpointUrl: structpb.NewStringValue("http://" + server.ApiAddr),
+						},
+					},
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
+							ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
+						},
+					},
+				},
+				CurrentBucket: &storagebuckets.StorageBucket{
+					BucketName: bucketName,
+					Attributes: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							ConstEndpointUrl: structpb.NewStringValue("http://" + server.ApiAddr),
+						},
+					},
+				},
+				Persisted: &storagebuckets.StorageBucketPersisted{
+					Data: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
+							ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
+						},
+					},
+				},
+			},
+			err:     "The specified service account is not found (Specified service account does not exist)",
+			errCode: codes.InvalidArgument,
+		},
 		{
 			name: "dryRunFail",
 			req: &plugin.OnUpdateStorageBucketRequest{
@@ -871,11 +845,6 @@ func TestOnUpdateStorageBucket(t *testing.T) {
 			},
 			err:     "failed to verify provided minio environment: failed to put object",
 			errCode: codes.InvalidArgument,
-			expectedPermissions: &pb.Permissions{
-				Write:  &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "Access Denied."},
-				Read:   &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: "The specified key does not exist."},
-				Delete: &pb.Permission{State: pb.StateType_STATE_TYPE_OK, ErrorDetails: ""},
-			},
 		},
 		{
 			name: "credRotationFailWithNewCreds",
@@ -938,7 +907,7 @@ func TestOnUpdateStorageBucket(t *testing.T) {
 			errCode: codes.InvalidArgument,
 		},
 		{
-			name: "credRotationNoNewCreds",
+			name: "credRotationFailNoNewCreds",
 			req: &plugin.OnUpdateStorageBucketRequest{
 				CurrentBucket: &storagebuckets.StorageBucket{
 					BucketName: bucketName,
@@ -950,12 +919,32 @@ func TestOnUpdateStorageBucket(t *testing.T) {
 					},
 				},
 				Persisted: &storagebuckets.StorageBucketPersisted{
-					Data: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstAccessKeyId:     structpb.NewStringValue(server.ServiceAccountAccessKeyId),
-							ConstSecretAccessKey: structpb.NewStringValue(server.ServiceAccountSecretAccessKey),
-						},
-					},
+					Data: func() *structpb.Struct {
+						creds, err := server.AdminClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
+							Policy: json.RawMessage(`
+							{
+								"Statement": [
+									{
+										"Action": [
+											"admin:CreateServiceAccount",
+											"admin:RemoveServiceAccount"
+										],
+										"Effect": "Deny"
+									}
+								],
+								"Version": "2012-10-17"
+							}
+							`),
+						})
+						require.NoError(t, err)
+
+						return &structpb.Struct{
+							Fields: map[string]*structpb.Value{
+								ConstAccessKeyId:     structpb.NewStringValue(creds.AccessKey),
+								ConstSecretAccessKey: structpb.NewStringValue(creds.SecretKey),
+							},
+						}
+					}(),
 				},
 				NewBucket: &storagebuckets.StorageBucket{
 					BucketName: bucketName,
@@ -967,55 +956,9 @@ func TestOnUpdateStorageBucket(t *testing.T) {
 					},
 				},
 			},
-			err:     "credential rotation enabled with no new credentials provided",
+			err:     "failed to rotate minio credentials: failed to create new minio service account: Access Denied.",
 			errCode: codes.InvalidArgument,
 		},
-		{
-			name: "successUsingNonServiceAccount",
-			req: &plugin.OnUpdateStorageBucketRequest{
-				NewBucket: &storagebuckets.StorageBucket{
-					BucketName: bucketName,
-					Attributes: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstEndpointUrl:               structpb.NewStringValue("http://" + server.ApiAddr),
-							ConstDisableCredentialRotation: structpb.NewBoolValue(true),
-						},
-					},
-					Secrets: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
-							ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
-						},
-					},
-				},
-				CurrentBucket: &storagebuckets.StorageBucket{
-					BucketName: bucketName,
-					Attributes: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstEndpointUrl: structpb.NewStringValue("http://" + server.ApiAddr),
-						},
-					},
-				},
-				Persisted: &storagebuckets.StorageBucketPersisted{
-					Data: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
-							ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
-						},
-					},
-				},
-			},
-			expected: &plugin.OnUpdateStorageBucketResponse{
-				Persisted: &storagebuckets.StorageBucketPersisted{
-					Data: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
-							ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
-						},
-					},
-				},
-			},
-		},
 		{
 			name: "successNoRotation",
 			req: &plugin.OnUpdateStorageBucketRequest{
@@ -1073,29 +1016,6 @@ func TestOnUpdateStorageBucket(t *testing.T) {
 				require.ErrorContains(err, tt.err)
 				require.Equal(tt.errCode.String(), status.Code(err).String())
 				require.Nil(res)
-
-				// Check the permission error.
-				if tt.expectedPermissions != nil {
-					st, ok := status.FromError(err)
-					require.True(ok)
-					var permission *pb.StorageBucketCredentialState
-					for _, detail := range st.Details() {
-						if errDetail, ok := detail.(*pb.StorageBucketCredentialState); ok {
-							permission = errDetail
-							break
-						}
-					}
-					require.NotNil(t, permission)
-
-					assert.Equal(t, tt.expectedPermissions.GetWrite().GetState(), permission.GetState().GetWrite().GetState())
-					assert.Equal(t, tt.expectedPermissions.GetRead().GetState(), permission.GetState().GetRead().GetState())
-					assert.Equal(t, tt.expectedPermissions.GetDelete().GetState(), permission.GetState().GetDelete().GetState())
-
-					assert.Contains(t, tt.expectedPermissions.GetWrite().GetErrorDetails(), permission.GetState().GetWrite().GetErrorDetails())
-					assert.Contains(t, tt.expectedPermissions.GetRead().GetErrorDetails(), permission.GetState().GetRead().GetErrorDetails())
-					assert.Contains(t, tt.expectedPermissions.GetDelete().GetErrorDetails(), permission.GetState().GetDelete().GetErrorDetails())
-				}
-
 				return
 			}

@@ -1191,6 +1111,77 @@ func TestOnUpdateStorageBucket_SuccessDisableCredRotationAndNewCreds(t *testing.
 	require.Len(t, lsa.Accounts, 2) // Creds in `server` + newCreds.
 }

+func TestOnUpdateStorageBucket_SuccessEnableCredRotationNoNewCreds(t *testing.T) {
+	ctx := context.Background()
+	server := internaltest.NewMinioServer(t)
+
+	bucketName := "test"
+	err := server.Client.MakeBucket(ctx, bucketName, minio.MakeBucketOptions{})
+	require.NoError(t, err)
+
+	persistedCreds, err := server.AdminClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{})
+	require.NoError(t, err)
+
+	req := &plugin.OnUpdateStorageBucketRequest{
+		CurrentBucket: &storagebuckets.StorageBucket{
+			BucketName: bucketName,
+			Attributes: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					ConstEndpointUrl:               structpb.NewStringValue("http://" + server.ApiAddr),
+					ConstDisableCredentialRotation: structpb.NewBoolValue(true),
+				},
+			},
+		},
+		Persisted: &storagebuckets.StorageBucketPersisted{
+			Data: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					ConstAccessKeyId:     structpb.NewStringValue(persistedCreds.AccessKey),
+					ConstSecretAccessKey: structpb.NewStringValue(persistedCreds.SecretKey),
+				},
+			},
+		},
+		NewBucket: &storagebuckets.StorageBucket{
+			BucketName: bucketName,
+			Attributes: &structpb.Struct{
+				Fields: map[string]*structpb.Value{
+					ConstEndpointUrl:               structpb.NewStringValue("http://" + server.ApiAddr),
+					ConstDisableCredentialRotation: structpb.NewBoolValue(false),
+				},
+			},
+		},
+	}
+
+	// `disable_cred_rotation` disabled -> enable and provide no new creds.
+	// This should use the existing persisted credentials to generate new ones,
+	// then use those. The old persisted credentials should not be deleted.
+	sp := new(StoragePlugin)
+	rsp, err := sp.OnUpdateStorageBucket(ctx, req)
+	require.NoError(t, err)
+	require.NotNil(t, req)
+
+	outAccessKeyId, err := values.GetStringValue(rsp.GetPersisted().GetData(), ConstAccessKeyId, true)
+	require.NoError(t, err)
+	require.NotEqual(t, persistedCreds.AccessKey, outAccessKeyId)
+
+	outSecretAccessKey, err := values.GetStringValue(rsp.GetPersisted().GetData(), ConstSecretAccessKey, true)
+	require.NoError(t, err)
+	require.NotEqual(t, persistedCreds.SecretKey, outSecretAccessKey)
+
+	lastRotated, err := values.GetTimeValue(rsp.GetPersisted().GetData(), ConstLastRotatedTime)
+	require.NoError(t, err)
+	require.False(t, lastRotated.IsZero())
+
+	_, err = server.AdminClient.InfoServiceAccount(ctx, persistedCreds.AccessKey)
+	require.NoError(t, err)
+
+	_, err = server.AdminClient.InfoServiceAccount(ctx, outAccessKeyId)
+	require.NoError(t, err)
+
+	lsa, err := server.AdminClient.ListServiceAccounts(ctx, server.RootUsername)
+	require.NoError(t, err)
+	require.Len(t, lsa.Accounts, 3) // Creds in `server` + persistedCreds + newly rotated creds.
+}
+
 func TestOnUpdateStorageBucket_SuccessEnableCredRotationWithNewCreds(t *testing.T) {
 	ctx := context.Background()
 	server := internaltest.NewMinioServer(t)
@@ -1744,6 +1735,26 @@ func TestValidatePermissions(t *testing.T) {
 			},
 			expErrMsg: "empty secrets input",
 		},
+		{
+			name: "usingNonServiceAccount",
+			req: &plugin.ValidatePermissionsRequest{
+				Bucket: &storagebuckets.StorageBucket{
+					BucketName: bucketName,
+					Attributes: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							ConstEndpointUrl: structpb.NewStringValue("http://" + server.ApiAddr),
+						},
+					},
+					Secrets: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
+							ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
+						},
+					},
+				},
+			},
+			expErrMsg: "The specified service account is not found (Specified service account does not exist)",
+		},
 		{
 			name: "dryRunFail",
 			req: &plugin.ValidatePermissionsRequest{
@@ -1771,46 +1782,6 @@ func TestValidatePermissions(t *testing.T) {
 			},
 			expErrMsg: "failed to verify provided minio environment: failed to put object",
 		},
-		{
-			name: "rotatedNonServiceAccount",
-			req: &plugin.ValidatePermissionsRequest{
-				Bucket: &storagebuckets.StorageBucket{
-					BucketName: bucketName,
-					Attributes: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstEndpointUrl: structpb.NewStringValue("http://" + server.ApiAddr),
-						},
-					},
-					Secrets: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
-							ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
-							ConstLastRotatedTime: structpb.NewStringValue(time.Now().Format(time.RFC3339Nano)),
-						},
-					},
-				},
-			},
-			expErrMsg: "The specified service account is not found (Specified service account does not exist)",
-		},
-		{
-			name: "successNonServiceAccount",
-			req: &plugin.ValidatePermissionsRequest{
-				Bucket: &storagebuckets.StorageBucket{
-					BucketName: bucketName,
-					Attributes: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstEndpointUrl: structpb.NewStringValue("http://" + server.ApiAddr),
-						},
-					},
-					Secrets: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstAccessKeyId:     structpb.NewStringValue(server.RootUsername),
-							ConstSecretAccessKey: structpb.NewStringValue(server.RootPassword),
-						},
-					},
-				},
-			},
-		},
 		{
 			name: "success",
 			req: &plugin.ValidatePermissionsRequest{
@@ -1968,7 +1939,7 @@ func TestHeadObject(t *testing.T) {
 				},
 				Key: "doesnt-exist",
 			},
-			expErrMsg: "specified object does not exist",
+			expErrMsg: "failed to stat object: The specified key does not exist.",
 		},
 		{
 			name: "success",
@@ -2440,7 +2411,7 @@ func TestPutObject(t *testing.T) {
 	cases := []struct {
 		name    string
 		req     *plugin.PutObjectRequest
-		setup   func(*plugin.PutObjectRequest) ([]byte, error)
+		setup   func(*plugin.PutObjectRequest) (string, error)
 		err     string
 		errCode codes.Code
 	}{
@@ -2545,13 +2516,13 @@ func TestPutObject(t *testing.T) {
 				Key:  "test-key",
 				Path: dirPath("empty-test-file"),
 			},
-			setup: func(req *plugin.PutObjectRequest) ([]byte, error) {
+			setup: func(req *plugin.PutObjectRequest) (string, error) {
 				file, err := os.Create(req.Path)
 				if err != nil {
-					return nil, err
+					return "", err
 				}
 				file.Close()
-				return []byte{}, nil
+				return "", nil
 			},
 			err:     "file is empty",
 			errCode: codes.InvalidArgument,
@@ -2599,17 +2570,17 @@ func TestPutObject(t *testing.T) {
 				Key:  "test-key",
 				Path: dirPath("test-file"),
 			},
-			setup: func(req *plugin.PutObjectRequest) ([]byte, error) {
+			setup: func(req *plugin.PutObjectRequest) (string, error) {
 				file, err := os.Create(req.Path)
 				if err != nil {
-					return nil, err
+					return "", err
 				}
 				defer file.Close()

-				data := []byte("test file data")
+				data := "test file data"

-				if _, err = file.Write(data); err != nil {
-					return nil, err
+				if _, err = file.WriteString(data); err != nil {
+					return "", err
 				}
 				return data, nil
 			},
@@ -2635,59 +2606,17 @@ func TestPutObject(t *testing.T) {
 				Key:  "test-key-with-prefix",
 				Path: dirPath("test-file-with-prefix"),
 			},
-			setup: func(req *plugin.PutObjectRequest) ([]byte, error) {
+			setup: func(req *plugin.PutObjectRequest) (string, error) {
 				file, err := os.Create(req.Path)
 				if err != nil {
-					return nil, err
+					return "", err
 				}
 				defer file.Close()

-				data := []byte("test file data for bucket with prefix")
+				data := "test file data for bucket with prefix"

-				if _, err = file.Write(data); err != nil {
-					return nil, err
-				}
-				return data, nil
-			},
-		},
-		{
-			name: "successWithLargeFile",
-			req: &plugin.PutObjectRequest{
-				Bucket: &storagebuckets.StorageBucket{
-					BucketName: bucketName,
-					Attributes: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstEndpointUrl: structpb.NewStringValue("http://" + server.ApiAddr),
-						},
-					},
-					Secrets: &structpb.Struct{
-						Fields: map[string]*structpb.Value{
-							ConstAccessKeyId:     structpb.NewStringValue(server.ServiceAccountAccessKeyId),
-							ConstSecretAccessKey: structpb.NewStringValue(server.ServiceAccountSecretAccessKey),
-						},
-					},
-				},
-				Key:  "test-key-large-file",
-				Path: dirPath("test-file-large"),
-			},
-			setup: func(req *plugin.PutObjectRequest) ([]byte, error) {
-				file, err := os.Create(req.Path)
-				if err != nil {
-					return nil, err
-				}
-				defer file.Close()
-
-				data := make([]byte, 30e6)
-				n, err := rand.Reader.Read(data)
-				if err != nil {
-					return nil, err
-				}
-				if n != 30e6 {
-					return nil, fmt.Errorf("did not read 30 million bytes")
-				}
-
-				if _, err = file.Write(data); err != nil {
-					return nil, err
+				if _, err = file.WriteString(data); err != nil {
+					return "", err
 				}
 				return data, nil
 			},
@@ -2699,13 +2628,13 @@ func TestPutObject(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			assert, require := assert.New(t), require.New(t)
 			var checksum []byte
-			var content []byte
+			var content string
 			if tt.setup != nil {
 				var err error
 				content, err = tt.setup(tt.req)
 				require.NoError(err)
 				hash := sha256.New()
-				_, err = hash.Write(content)
+				_, err = hash.Write([]byte(content))
 				require.NoError(err)
 				checksum = hash.Sum(nil)
 				require.NoError(err)
@@ -2734,16 +2663,14 @@ func TestPutObject(t *testing.T) {
 			require.NoError(err)
 			defer obj.Close()

-			fmt.Printf("path: %v\n", tt.req.Path)
-			contentLen := len(content)
+			contentLen := len([]byte(content))
 			reader := bufio.NewReader(obj)
 			buffer := make([]byte, contentLen)
-			n, _ := reader.Read(buffer)
-			// large files, for some reason, yield an EOF error when you read the full thing
-			// require.NoError(err)
+			n, err := reader.Read(buffer)
+			require.NoError(err)

 			assert.Equal(contentLen, n)
-			assert.Equal(content, buffer)
+			assert.Equal(content, string(buffer))
 		})
 	}
 }
@@ -3046,18 +2973,12 @@ func TestDryRun(t *testing.T) {
 		makeBucketFn func(t *testing.T, cl *minio.Client) string
 		// This test verifies that each message in the err slice is contained in
 		// the error string, effectively &&-ing the checks together.
-		expErrMsgs     []string
-		expPermissions *pb.Permissions
+		expErrMsgs []string
 	}{
 		{
 			name:         "bucketNotExists",
 			makeBucketFn: func(t *testing.T, cl *minio.Client) string { return "unknownbucket" },
 			expErrMsgs:   []string{"The specified bucket does not exist"},
-			expPermissions: &pb.Permissions{
-				Write:  &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "The specified bucket does not exist"},
-				Read:   &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "The specified bucket does not exist"},
-				Delete: &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "The specified bucket does not exist"},
-			},
 		},
 		{
 			name: "putObjectFail",
@@ -3086,12 +3007,6 @@ func TestDryRun(t *testing.T) {
 				"failed to put object",
 				"Access Denied",
 			},
-			expPermissions: &pb.Permissions{
-				Write: &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "Access Denied."},
-				// The write permission is denied, so the any read operation will return with a no such key error.
-				Read:   &pb.Permission{State: pb.StateType_STATE_TYPE_UNKNOWN, ErrorDetails: "The specified key does not exist."},
-				Delete: &pb.Permission{State: pb.StateType_STATE_TYPE_OK},
-			},
 		},
 		{
 			name: "statObjectFail",
@@ -3120,11 +3035,6 @@ func TestDryRun(t *testing.T) {
 				"failed to stat object",
 				"Access Denied",
 			},
-			expPermissions: &pb.Permissions{
-				Write:  &pb.Permission{State: pb.StateType_STATE_TYPE_OK},
-				Read:   &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "Access Denied."},
-				Delete: &pb.Permission{State: pb.StateType_STATE_TYPE_OK},
-			},
 		},
 		{
 			name: "listObjectsFail",
@@ -3153,11 +3063,6 @@ func TestDryRun(t *testing.T) {
 				"failed to list objects in bucket",
 				"Access Denied",
 			},
-			expPermissions: &pb.Permissions{
-				Write:  &pb.Permission{State: pb.StateType_STATE_TYPE_OK},
-				Read:   &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "Access Denied."},
-				Delete: &pb.Permission{State: pb.StateType_STATE_TYPE_OK},
-			},
 		},
 		{
 			name: "removeObjectFail",
@@ -3186,37 +3091,6 @@ func TestDryRun(t *testing.T) {
 				"failed to remove object",
 				"Access Denied",
 			},
-			expPermissions: &pb.Permissions{
-				Write:  &pb.Permission{State: pb.StateType_STATE_TYPE_OK},
-				Read:   &pb.Permission{State: pb.StateType_STATE_TYPE_OK},
-				Delete: &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "Access Denied."},
-			},
-		},
-		{
-			name: "Invalid Access Key Id",
-			minioClFn: func(t *testing.T, s *internaltest.MinioServer) *minio.Client {
-				cl, err := minio.New(s.ApiAddr, &minio.Options{
-					Creds:  credentials.NewStaticV4("invalidAccessKey", "invalidSecretKey", ""),
-					Secure: false,
-				})
-				require.NoError(t, err)
-
-				return cl
-			},
-			makeBucketFn: func(t *testing.T, cl *minio.Client) string {
-				bucketName := "testdryrun-invalidaccesskeyid"
-				_ = cl.MakeBucket(ctx, bucketName, minio.MakeBucketOptions{})
-
-				return bucketName
-			},
-			expErrMsgs: []string{
-				"The Access Key Id you provided does not exist in our records",
-			},
-			expPermissions: &pb.Permissions{
-				Write:  &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "The Access Key Id you provided does not exist in our records."},
-				Read:   &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "The Access Key Id you provided does not exist in our records."},
-				Delete: &pb.Permission{State: pb.StateType_STATE_TYPE_ERROR, ErrorDetails: "The Access Key Id you provided does not exist in our records."},
-			},
 		},
 		{
 			name: "success",
@@ -3226,11 +3100,6 @@ func TestDryRun(t *testing.T) {
 				require.NoError(t, err)
 				return bucketName
 			},
-			expPermissions: &pb.Permissions{
-				Write:  &pb.Permission{State: pb.StateType_STATE_TYPE_OK},
-				Read:   &pb.Permission{State: pb.StateType_STATE_TYPE_OK},
-				Delete: &pb.Permission{State: pb.StateType_STATE_TYPE_OK},
-			},
 		},
 	}

@@ -3243,27 +3112,17 @@ func TestDryRun(t *testing.T) {
 			}

 			bucketName := tt.makeBucketFn(t, minioClient)
-			per, err := dryRun(ctx, minioClient, &storagebuckets.StorageBucket{
+			err := dryRun(ctx, minioClient, &storagebuckets.StorageBucket{
 				BucketName: bucketName,
 			})
-			if tt.expPermissions != nil {
-				assert.Equal(t, tt.expPermissions.GetWrite().GetState(), per.GetWrite().GetState())
-				assert.Equal(t, tt.expPermissions.GetRead().GetState(), per.GetRead().GetState())
-				assert.Equal(t, tt.expPermissions.GetDelete().GetState(), per.GetDelete().GetState())
-
-				assert.Contains(t, tt.expPermissions.GetWrite().GetErrorDetails(), per.GetWrite().GetErrorDetails())
-				assert.Contains(t, tt.expPermissions.GetRead().GetErrorDetails(), per.GetRead().GetErrorDetails())
-				assert.Contains(t, tt.expPermissions.GetDelete().GetErrorDetails(), per.GetDelete().GetErrorDetails())
-			}
-			require.NotNil(t, per)
 			if len(tt.expErrMsgs) > 0 {
 				for _, errMsg := range tt.expErrMsgs {
-					require.ErrorContains(t, err.Unwrap(), errMsg)
+					require.ErrorContains(t, err, errMsg)
 				}
 				return
 			}

-			require.NoError(t, err.Unwrap())
+			require.NoError(t, err)
 		})
 	}
 }
@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package storage

 import (
@@ -76,9 +73,9 @@ func rotateCredentials(ctx context.Context, bucketName string, sa *StorageAttrib
 		LastRotatedTime: time.Now(),
 	}

-	inCl := inSec.Clone()
+	inCl, newCl := inSec.Clone(), newSec.Clone()
 	return newSec, sync.OnceValue(func() error {
-		ac, err := newMadminClient(sa, inCl)
+		ac, err := newMadminClient(sa, newCl)
 		if err != nil {
 			return fmt.Errorf("failed to create minio admin client: %w", err)
 		}
@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package storage

 import (
@@ -24,13 +21,13 @@ func TestRotateCredentials(t *testing.T) {

 	tests := []struct {
 		name       string
-		inSec      *StorageSecrets
+		ss         *StorageSecrets
 		expErrMsg  string
 		credDelErr bool
 	}{
 		{
 			name: "notUsingServiceAccount",
-			inSec: &StorageSecrets{
+			ss: &StorageSecrets{
 				AccessKeyId:     server.RootUsername,
 				SecretAccessKey: server.RootPassword,
 			},
@@ -38,7 +35,7 @@ func TestRotateCredentials(t *testing.T) {
 		},
 		{
 			name: "addServiceAccountFail",
-			inSec: func() *StorageSecrets {
+			ss: func() *StorageSecrets {
 				creds, err := server.AdminClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{
 					Policy: json.RawMessage(`
 					{
@@ -66,7 +63,7 @@ func TestRotateCredentials(t *testing.T) {
 		},
 		{
 			name: "credentialDeletionFail",
-			inSec: func() *StorageSecrets {
+			ss: func() *StorageSecrets {
 				creds, err := server.AdminClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{})
 				require.NoError(t, err)

@@ -79,7 +76,7 @@ func TestRotateCredentials(t *testing.T) {
 		},
 		{
 			name: "success",
-			inSec: func() *StorageSecrets {
+			ss: func() *StorageSecrets {
 				creds, err := server.AdminClient.AddServiceAccount(ctx, madmin.AddServiceAccountReq{})
 				require.NoError(t, err)

@@ -98,26 +95,26 @@ func TestRotateCredentials(t *testing.T) {
 				UseSSL:      false,
 			}

-			outSec, delFn, err := rotateCredentials(context.Background(), bucketName, sa, tt.inSec)
+			ss, delFn, err := rotateCredentials(context.Background(), bucketName, sa, tt.ss)
 			if tt.expErrMsg != "" {
 				require.ErrorContains(t, err, tt.expErrMsg)
-				require.Nil(t, outSec)
+				require.Nil(t, ss)
 				require.Nil(t, delFn)
 				return
 			}

 			require.NoError(t, err)
-			require.NotNil(t, outSec)
+			require.NotNil(t, ss)
 			require.NotNil(t, delFn)
-			require.NotEqual(t, outSec.AccessKeyId, tt.inSec.AccessKeyId)
-			require.NotEqual(t, outSec.SecretAccessKey, tt.inSec.SecretAccessKey)
-			require.NotEmpty(t, outSec.LastRotatedTime)
+			require.NotEqual(t, ss.AccessKeyId, tt.ss.AccessKeyId)
+			require.NotEqual(t, ss.SecretAccessKey, tt.ss.SecretAccessKey)
+			require.NotEmpty(t, ss.LastRotatedTime)

 			// Ensure old creds still exist since the callback hasn't been
 			// called. We then make the delete call and finally assert that the
 			// credential was removed if there was no error when attempting to
 			// delete.
-			_, err = server.AdminClient.InfoServiceAccount(ctx, tt.inSec.AccessKeyId)
+			_, err = server.AdminClient.InfoServiceAccount(ctx, tt.ss.AccessKeyId)
 			require.NoError(t, err)

 			if tt.credDelErr {
@@ -125,7 +122,7 @@ func TestRotateCredentials(t *testing.T) {
 				require.ErrorContains(t, delFn(), "failed to delete minio service account")
 				require.ErrorContains(t, delFn(), "failed to delete minio service account") // 2nd call should return the same state (due to sync.Once).

-				_, err := server.AdminClient.InfoServiceAccount(ctx, tt.inSec.AccessKeyId)
+				_, err := server.AdminClient.InfoServiceAccount(ctx, tt.ss.AccessKeyId)
 				require.NoError(t, err)
 				return
 			} else {
@@ -133,7 +130,7 @@ func TestRotateCredentials(t *testing.T) {
 				require.NoError(t, delFn()) // 2nd call should return the same state (due to sync.Once).
 			}

-			_, err = server.AdminClient.InfoServiceAccount(ctx, tt.inSec.AccessKeyId)
+			_, err = server.AdminClient.InfoServiceAccount(ctx, tt.ss.AccessKeyId)
 			require.ErrorContains(t, err, "service account is not found")
 		})
 	}
Author	SHA1	Message	Date
Danielle Miu	45689608ce	Merge remote-tracking branch 'origin/hugo-cred-rotation' into test-delete-cred-rotation	2024-03-27 12:31:25 -04:00
Danielle Miu	7399e1287c	feat(plugin): implement DeleteObjects functionality along with associated automated tests	2024-03-26 00:19:01 -04:00
Hugo	8b87e8bb6a	feat(plugin): Implement Credential Rotation	2024-03-22 15:20:11 +00:00
Hugo	4650c21480	feat(plugin): Add credential rotation primitives	2024-03-22 15:18:35 +00:00
Hugo	9bc4434194	feat(values): Add methods to get bool and time values from proto	2024-03-22 15:17:40 +00:00