(aws-s3): grantWrite generates s3:PutObject* (globbed) action instead of an enumeration of s3:PutObject actions

[raginjason]

Describe the bug

It appears that v1.141.0/v2.10.0 introduced the following change:

• s3: add missing safe actions to grantWrite, grantReadWrite and grantPut methods (#18494) (940d043), closes #13616

However, this does not seem to actually apply to any release in CDKv1.

Expected Behavior

cdk synth to output enumerated s3:PutObject actions. Expected output would would be something like this

  FnServiceRoleDefaultPolicyC6A839BF:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - s3:DeleteObject*
              - s3:PutObject,
              - s3:PutObjectLegalHold,
              - s3:PutObjectRetention,
              - s3:PutObjectTagging,
              - s3:PutObjectVersionTagging,
              - s3:Abort*
            Effect: Allow
            Resource:
  ...

Current Behavior

cdk synth outputs globbed s3:PutObject* actions:

  FnServiceRoleDefaultPolicyC6A839BF:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - s3:DeleteObject*
              - s3:PutObject*,
              - s3:Abort*
            Effect: Allow
            Resource:
  ...

I tested this against v1.140, v1.141 and v1.173; all generated templates look the same as above.

Reproduction Steps

Execute cdk synth | grep -A 10 '^[ ]\+FnServiceRoleDefaultPolicy' with the following app.py:

from aws_cdk import aws_s3 as s3
from aws_cdk import aws_lambda as lambda_
from aws_cdk.core import Construct, App, Stack


class TestStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        bucket = s3.Bucket(
            self,
            "Bucket",
        )

        fn = lambda_.Function(
            self,
            "Fn",
            code=lambda_.Code.from_inline("import sys"),
            runtime=lambda_.Runtime.PYTHON_3_9,
            handler="main",
        )

        bucket.grant_write(fn)


app = App()
TestStack(app, "Test")

app.synth()

This outputs the following globbed s3:PutObject* action instead of the various enumerated s3:PutObject actions mentioned in #18494 :

  FnServiceRoleDefaultPolicyC6A839BF:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - s3:DeleteObject*
              - s3:PutObject*
              - s3:Abort*
            Effect: Allow
            Resource:
...

Possible Solution

No response

Additional Information/Context

This was discovered in the process of migrating our codebase from CDKv1 to CDKv2. Along the way, this generated a cdk diff with many changes like the following:

            [-]   "s3:PutObject*",
            [+]   "s3:PutObject",
            [+]   "s3:PutObjectLegalHold",
            [+]   "s3:PutObjectRetention",
            [+]   "s3:PutObjectTagging",
            [+]   "s3:PutObjectVersionTagging",

CDK CLI Version

1.173.0

Framework Version

No response

Node.js Version

v14.17.6

OS

macOS Monterey 12.6

Language

Python

Language Version

Python 3.9.6

Other information

For completeness, I also tested this with v2.0.0, v2.9.0, and v2.10.0. app.py:

from aws_cdk import aws_s3 as s3
from aws_cdk import aws_lambda as lambda_
from constructs import Construct
from aws_cdk import App, Stack


class TestStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        bucket = s3.Bucket(
            self,
            "Bucket",
        )

        fn = lambda_.Function(
            self,
            "Fn",
            code=lambda_.Code.from_inline("import sys"),
            runtime=lambda_.Runtime.PYTHON_3_9,
            handler="main",
        )

        bucket.grant_write(fn)


app = App()
TestStack(app, "Test")

app.synth()

v2.0.0 and v2.9.0 output the following:

  FnServiceRoleDefaultPolicyC6A839BF:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - s3:DeleteObject*
              - s3:PutObject
              - s3:Abort*
            Effect: Allow
            Resource:
...

v2.10.0 outputs the following:

  FnServiceRoleDefaultPolicyC6A839BF:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - s3:DeleteObject*
              - s3:PutObject
              - s3:PutObjectLegalHold
              - s3:PutObjectRetention
              - s3:PutObjectTagging
              - s3:PutObjectVersionTagging
              - s3:Abort*
            Effect: Allow
            Resource:
...

The above is consistent with what I would expect from the changelog, so this appears to be CDKv1 issue.

[peterwoodworth]

Thanks for reporting this @raginjason,

However I'm not able to reproduce your findings. If I toggle between v1.140.0 and v1.141.0 I can see the expected difference in the Policy.

Our version tags also show the difference (v1.141.0,v1.140.0). I suspect you may have had some strange issues in your environment when migrating between different v1 versions which prevented you from seeing this change.

[raginjason]

@peterwoodworth that's very odd, as I did this in a brand new environment:

python3 -m venv .venv
source .venv/bin/activate
python3 -m pip install --upgrade pip
pip install -qq aws_cdk.aws_s3==1.141.0 aws_cdk.aws_lambda==1.141.0
npx cdk@1.141.0 synth | grep -A 10 '^[ ]\+FnServiceRoleDefaultPolicy'

Which outputs the globbed s3:PutObject* action, not the various enumerated PutObject values.

[peterwoodworth]

That's interesting, I'm still not able to reproduce this. Given this, and the fact that v1 is in maintenance mode, I'll be closing this issue out. Thanks again for reporting!

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.