fix(s3): grantRead does not allow s3:HeadObject by lpizzinidev · Pull Request #27416 · aws/aws-cdk

lpizzinidev · 2023-10-05T14:16:41Z

Fixes the policy enforced by grantRead to allow operations that require to read an object's metadata, for example:

s3 = boto3.client("s3")
# this operation requires s3:HeadObject permission
s3.download_file(bucket, key, filepath)

Closes #27389.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

lpizzinidev · 2023-10-06T14:48:41Z

Exemption Request.
The bucket.grantRead function already has extensive coverage in both unit and functional tests.

tmokmss

Thank you!

vinayak-kukreja

Thank you for your contribution. And, thank you @tmokmss for reviewing the PR. :)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Pull request has been modified.

mergify · 2023-10-11T02:09:51Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2023-10-11T02:38:40Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: c2e7a2e
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2023-10-11T02:39:01Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

sixcorners · 2023-10-11T20:57:17Z

Is HeadObject a real action? I think the iam console seems to see s3:HeadObject as an unrecognized action.. Unless I messed something up.

lpizzinidev · 2023-10-12T06:18:22Z

@sixcorners
It seems you're right.

@tmokmss Thoughts?

tmokmss · 2023-10-12T12:24:42Z

@lpizzinidev @sixcorners Hmm, I confirmed that you are right. There's no action named s3:HeadObject (source) and HeadObject API succeeds if GetObject is allowed. So I misunderstood that the 403 error I was getting with the HeadObject was due to lack of IAM permission, but in fact it was because the object with the specified key did not exist and listBucket action was not allowed (source). Sorry for me jumping to a wrong conclusion 🙏 (I believe it's at least not a huge problem because deployment succeeds anyway, isn't it?)

I think we should revert this change. Maybe we can discuss if we should allow listBucket as well, but that's a completely different issue...

lpizzinidev · 2023-10-12T12:35:45Z

@tmokmss Agree.
@vinayak-kukreja This PR should be reverted as it is adding an unrecognized action to the policy.
@sixcorners Thanks for the feedback! 💪

zxkane · 2023-10-16T03:40:03Z

The unrecoginized s3:HeadObject will break the cfn-lint scan.

This reverts commit beac675.

…27556) This reverts commit beac675. Comments on #27416 demonstrate that the PR was created due to misunderstanding of an error message. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

aws-cdk-automation requested a review from a team October 5, 2023 14:16

github-actions Bot added bug This issue is a bug. effort/small Small work item – less than a day of effort p2 distinguished-contributor [Pilot] contributed 50+ PRs to the CDK labels Oct 5, 2023

aws-cdk-automation previously requested changes Oct 5, 2023

View reviewed changes

lpizzinidev force-pushed the gh-27389 branch from 4e55e37 to 2d9cdda Compare October 5, 2023 15:42

lpizzinidev changed the title ~~fix(s3): grantRead allow s3:HeadObject~~ fix(s3): grantRead does not allow s3:HeadObject Oct 6, 2023

lpizzinidev force-pushed the gh-27389 branch 3 times, most recently from 6f0a25d to bc06577 Compare October 6, 2023 13:01

fix(s3): grantRead does not allow s3:HeadObject

5026000

lpizzinidev force-pushed the gh-27389 branch from bc06577 to 5026000 Compare October 6, 2023 13:58

aws-cdk-automation added pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Oct 6, 2023

tmokmss approved these changes Oct 10, 2023

View reviewed changes

aws-cdk-automation added pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Oct 10, 2023

vinayak-kukreja added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Oct 11, 2023

vinayak-kukreja previously approved these changes Oct 11, 2023

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Oct 11, 2023

Merge branch 'main' into awsgh-27389

53b94c9

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Oct 11, 2023

vinayak-kukreja approved these changes Oct 11, 2023

View reviewed changes

Merge branch 'main' into awsgh-27389

c2e7a2e

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Oct 11, 2023

mergify Bot merged commit beac675 into aws:main Oct 11, 2023

days-later mentioned this pull request Oct 14, 2023

pipelines: UpdatePipeline stage fails on invalid S3 policy #27542

Closed

kaizencc added a commit that referenced this pull request Oct 16, 2023

Revert "fix(s3): grantRead does not allow s3:HeadObject (#27416)"

fa7337c

This reverts commit beac675.

kaizencc mentioned this pull request Oct 16, 2023

revert: "fix(s3): grantRead does not allow s3:HeadObject (#27416)" #27556

Merged

MrArnoldPalmer mentioned this pull request Oct 16, 2023

❗ NOTICE: Policy has invalid action (Service: S3, Status Code: 400, #27547

Closed

github-actions Bot mentioned this pull request Nov 1, 2023

Monthly PR metrics report - October 2023 #27786

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(s3): grantRead does not allow s3:HeadObject#27416

fix(s3): grantRead does not allow s3:HeadObject#27416
mergify[bot] merged 3 commits intoaws:mainfrom
lpizzinidev:gh-27389

lpizzinidev commented Oct 5, 2023

Uh oh!

aws-cdk-automation left a comment

Uh oh!

lpizzinidev commented Oct 6, 2023

Uh oh!

tmokmss left a comment

Uh oh!

vinayak-kukreja left a comment

Uh oh!

mergify Bot commented Oct 11, 2023

Uh oh!

aws-cdk-automation commented Oct 11, 2023

Uh oh!

mergify Bot commented Oct 11, 2023

Uh oh!

sixcorners commented Oct 11, 2023

Uh oh!

lpizzinidev commented Oct 12, 2023

Uh oh!

tmokmss commented Oct 12, 2023 •

edited

Loading

Uh oh!

lpizzinidev commented Oct 12, 2023

Uh oh!

zxkane commented Oct 16, 2023 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

lpizzinidev commented Oct 5, 2023

Uh oh!

aws-cdk-automation left a comment

Choose a reason for hiding this comment

Uh oh!

lpizzinidev commented Oct 6, 2023

Uh oh!

tmokmss left a comment

Choose a reason for hiding this comment

Uh oh!

vinayak-kukreja left a comment

Choose a reason for hiding this comment

Uh oh!

mergify Bot commented Oct 11, 2023

Uh oh!

aws-cdk-automation commented Oct 11, 2023

AWS CodeBuild CI Report

Uh oh!

mergify Bot commented Oct 11, 2023

Uh oh!

sixcorners commented Oct 11, 2023

Uh oh!

lpizzinidev commented Oct 12, 2023

Uh oh!

tmokmss commented Oct 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lpizzinidev commented Oct 12, 2023

Uh oh!

zxkane commented Oct 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

tmokmss commented Oct 12, 2023 •

edited

Loading

zxkane commented Oct 16, 2023 •

edited

Loading