From cb4e9a211c6fd95db3030f6ac60b3e70134fda48 Mon Sep 17 00:00:00 2001
From: Harshavardhana <harsha@minio.io>
Date: Mon, 26 Oct 2026 16:26:18 -0700
Subject: [PATCH] fix: let replicationAdmin set and read bucket replication
 targets

mc replicate add creates the remote target before the replication config,
and that needs admin:SetBucketTarget, so a replicationAdmin user could not
set up bucket replication. Grant admin:SetBucketTarget and GetBucketTarget.
---
 policy/constants.go      |  3 +++
 policy/constants_test.go | 16 ++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/policy/constants.go b/policy/constants.go
index d714833..2ac5417 100644
--- a/policy/constants.go
+++ b/policy/constants.go
@@ -442,6 +442,9 @@ var DefaultPolicies = []struct {
 						Action(TablesReplicationInfoAction),
 						Action(TablesReplicationStartFailoverAction),
 						Action(TablesReplicationCatalogAdminAction),
+						// Bucket replication targets
+						Action(SetBucketTargetAction),
+						Action(GetBucketTargetAction),
 						// Replication diagnostics
 						Action(ReplicationDiff),
 					),
diff --git a/policy/constants_test.go b/policy/constants_test.go
index 65b2804..aa0bcef 100644
--- a/policy/constants_test.go
+++ b/policy/constants_test.go
@@ -203,3 +203,19 @@ func TestDefaultPolicyConsoleAdminAllowsFiles(t *testing.T) {
 		}
 	}
 }
+
+func TestDefaultPolicyReplicationAdminAllowsBucketTargets(t *testing.T) {
+	p, ok := findDefaultPolicy("replicationAdmin")
+	if !ok {
+		t.Fatal("replicationAdmin default policy not found")
+	}
+	if err := p.Validate(); err != nil {
+		t.Fatalf("replicationAdmin policy invalid: %v", err)
+	}
+	// mc replicate add sets the remote target before the replication config.
+	for _, action := range []AdminAction{SetBucketTargetAction, GetBucketTargetAction} {
+		if !p.IsAllowed(Args{AccountName: "repl", Action: Action(action), BucketName: "photos"}) {
+			t.Errorf("replicationAdmin should allow %v", action)
+		}
+	}
+}