Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(s3): add missing safe actions to grantWrite, grantReadWrite and grantPut methods #18494

Merged
merged 13 commits into from Jan 25, 2022
Merged

fix(s3): add missing safe actions to grantWrite, grantReadWrite and grantPut methods #18494

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
b273693
add missing safe actions to perms BUCKET_PUT_ACTIONS and s3:PutObject…
Jan 18, 2022
5330389
fix bucket integ tests
Jan 18, 2022
2d9f04f
Merge branch 'aws:master' into feature/fix-s3-write-permissions
flavioleggio Jan 18, 2022
069b745
fix other packages integ tests
Jan 19, 2022
f0da7e9
fix expected s3 policy output in unit tests
Jan 19, 2022
1871e32
add s3:PutObjectVersionAcl to policy actions in tests when grantPutAc…
Jan 19, 2022
0c192eb
Merge remote-tracking branch 'upstream/master' into feature/fix-s3-wr…
Jan 21, 2022
d6a2900
Merge branch 'master' into feature/fix-s3-write-permissions
flavioleggio Jan 22, 2022
c9e12a1
Merge branch 'master' into feature/fix-s3-write-permissions
flavioleggio Jan 25, 2022
17b926d
fix alb test
Jan 25, 2022
8b6d9af
Merge branch 'master' into feature/fix-s3-write-permissions
flavioleggio Jan 25, 2022
d4e72bf
remove decdk files
flavioleggio Jan 25, 2022
e7d3f86
Merge branch 'master' into feature/fix-s3-write-permissions
mergify[bot] Jan 25, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 4 additions & 0 deletions packages/@aws-cdk/app-delivery/test/integ.cicd.expected.json
View file
Open in desktop
Expand Up @@ -34,6 +34,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down
6 changes: 5 additions & 1 deletion packages/@aws-cdk/aws-codebuild/test/integ.caching.expected.json
View file
Open in desktop
Expand Up @@ -34,6 +34,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -171,4 +175,4 @@
}
}
}
}
}
6 changes: 5 additions & 1 deletion packages/@aws-cdk/aws-codebuild/test/integ.project-buildspec-artifacts.expected.json
View file
Open in desktop
Expand Up @@ -34,6 +34,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -166,4 +170,4 @@
}
}
}
}
}
6 changes: 5 additions & 1 deletion packages/@aws-cdk/aws-codebuild/test/integ.project-logging.expected.json
View file
Open in desktop
Expand Up @@ -39,6 +39,10 @@
"Action": [
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -223,4 +227,4 @@
}
}
}
}
}
6 changes: 5 additions & 1 deletion packages/@aws-cdk/aws-codebuild/test/integ.project-secondary-sources-artifacts.expected.json
View file
Open in desktop
Expand Up @@ -64,6 +64,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -218,4 +222,4 @@
}
}
}
}
}
5 changes: 4 additions & 1 deletion packages/@aws-cdk/aws-codepipeline-actions/test/bitbucket/bitbucket-source-action.test.ts
View file
Open in desktop
Expand Up @@ -91,7 +91,10 @@ describeDeprecated('BitBucket source Action', () => {
'PolicyDocument': {
'Statement': Match.arrayWith([
Match.objectLike({
'Action': 's3:PutObjectAcl',
'Action': [
's3:PutObjectAcl',
's3:PutObjectVersionAcl',
],
'Effect': 'Allow',
'Resource': {
'Fn::Join': [
Expand Down
5 changes: 4 additions & 1 deletion packages/@aws-cdk/aws-codepipeline-actions/test/codecommit/codecommit-source-action.test.ts
View file
Open in desktop
Expand Up @@ -554,7 +554,10 @@ describe('CodeCommit Source Action', () => {
Template.fromStack(repoStack).hasResourceProperties('AWS::IAM::Policy', {
PolicyDocument: {
Statement: Match.arrayWith([{
'Action': 's3:PutObjectAcl',
'Action': [
's3:PutObjectAcl',
's3:PutObjectVersionAcl',
],
'Effect': 'Allow',
'Resource': {
'Fn::Join': ['', [
Expand Down
5 changes: 4 additions & 1 deletion ...codepipeline-actions/test/codestar-connections/codestar-connections-source-action.test.ts
View file
Open in desktop
Expand Up @@ -93,7 +93,10 @@ describe('CodeStar Connections source Action', () => {
'PolicyDocument': {
'Statement': Match.arrayWith([
Match.objectLike({
'Action': 's3:PutObjectAcl',
'Action': [
's3:PutObjectAcl',
's3:PutObjectVersionAcl',
],
'Effect': 'Allow',
'Resource': {
'Fn::Join': ['', [
Expand Down
8 changes: 8 additions & 0 deletions ...ges/@aws-cdk/aws-codepipeline-actions/test/integ.cfn-template-from-repo.lit.expected.json
View file
Open in desktop
Expand Up @@ -159,6 +159,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -440,6 +444,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down
20 changes: 20 additions & 0 deletions ...ws-codepipeline-actions/test/integ.lambda-deployed-through-codepipeline.lit.expected.json
View file
Open in desktop
Expand Up @@ -153,6 +153,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -508,6 +512,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -621,6 +629,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -1350,6 +1362,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -1572,6 +1588,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down
8 changes: 8 additions & 0 deletions packages/@aws-cdk/aws-codepipeline-actions/test/integ.lambda-pipeline.expected.json
View file
Open in desktop
Expand Up @@ -153,6 +153,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -388,6 +392,10 @@
"Action": [
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down
8 changes: 8 additions & 0 deletions packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-alexa-deploy.expected.json
View file
Open in desktop
Expand Up @@ -163,6 +163,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -387,6 +391,10 @@
"Action": [
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down
8 changes: 8 additions & 0 deletions ...ages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-cfn-cross-region.expected.json
View file
Open in desktop
Expand Up @@ -39,6 +39,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -265,6 +269,10 @@
"Action": [
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down
8 changes: 8 additions & 0 deletions .../@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-cfn-with-action-role.expected.json
View file
Open in desktop
Expand Up @@ -164,6 +164,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -384,6 +388,10 @@
"Action": [
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down
12 changes: 12 additions & 0 deletions packages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-cfn.expected.json
View file
Open in desktop
Expand Up @@ -153,6 +153,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -440,6 +444,10 @@
"Action": [
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -563,6 +571,10 @@
"Action": [
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down
4 changes: 4 additions & 0 deletions ...ages/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-build-batch.expected.json
View file
Open in desktop
Expand Up @@ -110,6 +110,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down
12 changes: 12 additions & 0 deletions ...codepipeline-actions/test/integ.pipeline-code-build-multiple-inputs-outputs.expected.json
View file
Open in desktop
Expand Up @@ -110,6 +110,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -196,6 +200,10 @@
"Action": [
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -557,6 +565,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down
12 changes: 12 additions & 0 deletions ...ges/@aws-cdk/aws-codepipeline-actions/test/integ.pipeline-code-commit-build.expected.json
View file
Open in desktop
Expand Up @@ -92,6 +92,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -413,6 +417,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down Expand Up @@ -671,6 +679,10 @@
"s3:List*",
"s3:DeleteObject*",
"s3:PutObject",
"s3:PutObjectLegalHold",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutObjectVersionTagging",
"s3:Abort*"
],
"Effect": "Allow",
Expand Down