(aws-s3): bucket.grantRead to an organization principal grants public read access #32756
Description
Describe the bug
When using bucket.grantRead(org), the generated policy allows access to the bucket for all AWS accounts without a condition.
Regression Issue
- Select this option if this issue appears to be a regression.
Last Known Working CDK Version
No response
Expected Behavior
The policy should have a condition:
"bucketPolicy": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "bucket"
},
"PolicyDocument": {
"Statement": [
{
"Action": [
"s3:GetBucket*",
"s3:GetObject*",
"s3:List*"
],
"Condition": {
"StringEquals": {
"aws:PrincipalOrgID": "o-yyyyyyyyyy"
},
},
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Resource": [
{
"Fn::GetAtt": [
"bucket",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"bucket",
"Arn"
]
},
"/*"
]
]
}
]
}
],
"Version": "2012-10-17"
}
},
"Metadata": {
"aws:cdk:path": "Stack/bucket/Policy/Resource"
}
}Current Behavior
This policy gets generated:
"bucketPolicy": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "bucket"
},
"PolicyDocument": {
"Statement": [
{
"Action": [
"s3:GetBucket*",
"s3:GetObject*",
"s3:List*"
],
"Condition": {
"StringEquals": {}
},
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Resource": [
{
"Fn::GetAtt": [
"bucket",
"Arn"
]
},
{
"Fn::Join": [
"",
[
{
"Fn::GetAtt": [
"bucket",
"Arn"
]
},
"/*"
]
]
}
]
}
],
"Version": "2012-10-17"
}
},
"Metadata": {
"aws:cdk:path": "Stack/bucket/Policy/Resource"
}
}Reproduction Steps
const org = new iam.OrganizationPrincipal(orgName);
const bucket = new s3.Bucket(this, "bucket", {...});
bucket.grantRead(org);Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.150.0
Framework Version
No response
Node.js Version
18.18.2
OS
Ubuntu 24.04
Language
TypeScript
Language Version
No response
Other information
No response