(s3): missing actions in grantWrite for multipart uploads

[Wurstnase]

Describe the bug

Multipart uploads are not possible with bucket.grantWrite(grantable).

Expected Behavior

grantWrite should add following actions to allow multipart uploads

  "s3:AbortMultipartUpload",
  "s3:GetObject",
  "s3:ListBucketMultipartUploads",
  "s3:ListMultipartUploadParts",
  "s3:PutObject"

Current Behavior

grantWrite add following actions to a grantable.

"s3:Abort*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging"

Reproduction Steps

from aws_cdk import App
from aws_cdk import Environment
from aws_cdk import Stack
from aws_cdk import aws_iam as iam
from aws_cdk import aws_s3 as s3
from constructs import Construct


class Example(Stack):
    def __init__(
        self,
        scope: Construct,
        id: str,
        **kwargs,
    ) -> None:
        super().__init__(scope, id, **kwargs)

        bucket = s3.Bucket.from_bucket_name(self, "Bucket", bucket_name="foobar")
        role = iam.Role(self, "Role", assumed_by=iam.AnyPrincipal())

        bucket.grant_write(role)

app = App()
Example(app, "Example", env=Environment(region="us-east-1"))
app.synth()

Template

Metadata removed.

{
 "Resources": {
  "Role1ABCC5F0": {
   "Type": "AWS::IAM::Role",
   "Properties": {
    "AssumeRolePolicyDocument": {
     "Statement": [
      {
       "Action": "sts:AssumeRole",
       "Effect": "Allow",
       "Principal": {
        "AWS": "*"
       }
      }
     ],
     "Version": "2012-10-17"
    }
   }
  },
  "RoleDefaultPolicy5FFB7DAB": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": [
        "s3:Abort*",
        "s3:DeleteObject*",
        "s3:PutObject",
        "s3:PutObjectLegalHold",
        "s3:PutObjectRetention",
        "s3:PutObjectTagging",
        "s3:PutObjectVersionTagging"
       ],
       "Effect": "Allow",
       "Resource": [
        "arn:aws:s3:::foobar",
        "arn:aws:s3:::foobar/*"
       ]
      }
     ],
     "Version": "2012-10-17"
    },
    "PolicyName": "RoleDefaultPolicy5FFB7DAB",
    "Roles": [
     {
      "Ref": "Role1ABCC5F0"
     }
    ]
   }
  }
 }
}

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.85.0

Framework Version

2.85.0

Node.js Version

OS

Language

Python

Language Version

Python (3.10.12)

Other information

No response

[peterwoodworth]

grantWrite should add following actions to allow multipart uploads

"s3:AbortMultipartUpload",
"s3:GetObject",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:PutObject"

Like you said, it grants PutObject and Abort* already, so two of these are already covered. The others aren't writing operations, so they shouldn't be granted with grantWrite(). You can grant these other actions with grantRead(), or just use grantReadWrite().

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[Wurstnase]

Sounds reasonable. Thanks.