feat(policy): add aws:TagKeys and aws:RequestTag for table and warehouse tag writes

[harshavardhana]

Description

Adds the condition keys aws:TagKeys and aws:RequestTag/<key>. TagTable, TagWarehouse and CreateTable accept both.
UntagTable and UntagWarehouse accept aws:TagKeys. Other actions refuse them.

Motivation and Context

A policy could allow or deny a whole table or warehouse tag action, but not the keys or values in the request. AWS
evaluates these keys for S3 Tables tagging, so a policy can, for example, deny writes to orb.governance.* keys.
miniohq/aistor#8032 consumes this.

How to test this PR?

go test ./policy/... (TestS3TablesRequestTagConditions, TestConditionVariableAllowedOnTagKeys)

Summary by CodeRabbit

• New Features
  • S3 Tables access policies now support aws:RequestTag and aws:TagKeys conditions for applicable table and warehouse tagging actions.
  • Policies can evaluate individual request-tag values and restrict which tag keys may be added or removed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: bc6a5cd4-0f24-441f-8102-e54d99507030

📥 Commits

Reviewing files that changed from the base of the PR and between 79d8a7b and 89eee26.

📒 Files selected for processing (4)

• policy/condition/keyname.go
• policy/condition_variable_test.go
• policy/table-action.go
• policy/table_request_tag_test.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The policy condition-key registry now includes aws:RequestTag and aws:TagKeys. S3 Tables action mappings accept these keys for applicable create, tag, and untag actions. Tests cover policy decisions and condition-key parsing.

Changes

S3 Tables tag conditions

Layer / File(s)	Summary
Register tag condition keys policy/condition/keyname.go	The condition-key registry adds AWSRequestTag and AWSTagKeys. AWSRequestTag accepts a /<key> suffix, and both keys are included in AllSupportedKeys.
Map tag conditions to actions policy/table-action.go, policy/table_request_tag_test.go, policy/condition_variable_test.go	CreateTable accepts both condition keys. Tag actions accept both keys, and untag actions accept AWSTagKeys. Tests cover allowed and denied policy cases, parsing restrictions, and aws:RequestTag/team on TagTable.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested reviewers: taran-p

Merge Risk: ⚪ Minimal · up to 89eee

No demonstrated issue blocks merging. The downstream integration should still be checked when its handler implementation is available.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding aws:TagKeys and aws:RequestTag support for table and warehouse tag writes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the tags at play
Request keys guide the policy’s way
Tag keys pass or meet a gate
Table tests confirm each state
Then hops away to nibble hay}

_{Comment @coderabbitai help to get the list of available commands.}