Skip to content

Commit 0e9440b

Browse files
MrArnoldPalmercorymhall
MrArnoldPalmer
and
corymhall
authored
fix: log buckets don't have acls enabled (#25303)
Set ObjectOwnership: ObjectWriter automatically if and only if: - It is not provided by the user - AccessControl ACLs are configured (only if AccessControl != PRIVATE) If the user does supply ObjectOwnership != ObjectWriter AND they try to set ACLs, we should error. `ObjectWriter` was essentially the default behavior before the change to disable ACLs by default for new buckets so though this will update existing buckets it should not cause any breakage or replacement. Closes #25288 --------- Co-authored-by: corymhall <[email protected]>
1 parent 460e487 commit 0e9440b

15 files changed

+881
-13
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-acls.js.snapshot/BucketOwnerFullControl.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"c5d89de727de047b0b75da8185709c8fa329fc4ad9497705d05c1956a40363df": {
5+
"source": {
6+
"path": "BucketOwnerFullControl.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "c5d89de727de047b0b75da8185709c8fa329fc4ad9497705d05c1956a40363df.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-acls.js.snapshot/BucketOwnerFullControl.template.json

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"Resources": {
3+
"IntegBucketD47DF7CA": {
4+
"Type": "AWS::S3::Bucket",
5+
"Properties": {
6+
"AccessControl": "BucketOwnerFullControl",
7+
"OwnershipControls": {
8+
"Rules": [
9+
{
10+
"ObjectOwnership": "BucketOwnerEnforced"
11+
}
12+
]
13+
}
14+
},
15+
"UpdateReplacePolicy": "Delete",
16+
"DeletionPolicy": "Delete"
17+
}
18+
},
19+
"Parameters": {
20+
"BootstrapVersion": {
21+
"Type": "AWS::SSM::Parameter::Value<String>",
22+
"Default": "/cdk-bootstrap/hnb659fds/version",
23+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
24+
}
25+
},
26+
"Rules": {
27+
"CheckBootstrapVersion": {
28+
"Assertions": [
29+
{
30+
"Assert": {
31+
"Fn::Not": [
32+
{
33+
"Fn::Contains": [
34+
[
35+
"1",
36+
"2",
37+
"3",
38+
"4",
39+
"5"
40+
],
41+
{
42+
"Ref": "BootstrapVersion"
43+
}
44+
]
45+
}
46+
]
47+
},
48+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
49+
}
50+
]
51+
}
52+
}
53+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-acls.js.snapshot/BucketOwnerRead.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"cd03051e579b08328849c49cd840e271660c756be655c14b55c6ef670dbe692e": {
5+
"source": {
6+
"path": "BucketOwnerRead.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "cd03051e579b08328849c49cd840e271660c756be655c14b55c6ef670dbe692e.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-acls.js.snapshot/BucketOwnerRead.template.json

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"Resources": {
3+
"IntegBucketD47DF7CA": {
4+
"Type": "AWS::S3::Bucket",
5+
"Properties": {
6+
"AccessControl": "BucketOwnerRead",
7+
"OwnershipControls": {
8+
"Rules": [
9+
{
10+
"ObjectOwnership": "BucketOwnerEnforced"
11+
}
12+
]
13+
}
14+
},
15+
"UpdateReplacePolicy": "Delete",
16+
"DeletionPolicy": "Delete"
17+
}
18+
},
19+
"Parameters": {
20+
"BootstrapVersion": {
21+
"Type": "AWS::SSM::Parameter::Value<String>",
22+
"Default": "/cdk-bootstrap/hnb659fds/version",
23+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
24+
}
25+
},
26+
"Rules": {
27+
"CheckBootstrapVersion": {
28+
"Assertions": [
29+
{
30+
"Assert": {
31+
"Fn::Not": [
32+
{
33+
"Fn::Contains": [
34+
[
35+
"1",
36+
"2",
37+
"3",
38+
"4",
39+
"5"
40+
],
41+
{
42+
"Ref": "BootstrapVersion"
43+
}
44+
]
45+
}
46+
]
47+
},
48+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
49+
}
50+
]
51+
}
52+
}
53+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-acls.js.snapshot/Private.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"cd71a9eeaf11c0cb27fee1df2427db744d7a065bab534cb246a45d1a5d7f6292": {
5+
"source": {
6+
"path": "Private.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "cd71a9eeaf11c0cb27fee1df2427db744d7a065bab534cb246a45d1a5d7f6292.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-acls.js.snapshot/Private.template.json

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{
2+
"Resources": {
3+
"IntegBucketD47DF7CA": {
4+
"Type": "AWS::S3::Bucket",
5+
"Properties": {
6+
"AccessControl": "Private",
7+
"OwnershipControls": {
8+
"Rules": [
9+
{
10+
"ObjectOwnership": "BucketOwnerEnforced"
11+
}
12+
]
13+
}
14+
},
15+
"UpdateReplacePolicy": "Delete",
16+
"DeletionPolicy": "Delete"
17+
}
18+
},
19+
"Parameters": {
20+
"BootstrapVersion": {
21+
"Type": "AWS::SSM::Parameter::Value<String>",
22+
"Default": "/cdk-bootstrap/hnb659fds/version",
23+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
24+
}
25+
},
26+
"Rules": {
27+
"CheckBootstrapVersion": {
28+
"Assertions": [
29+
{
30+
"Assert": {
31+
"Fn::Not": [
32+
{
33+
"Fn::Contains": [
34+
[
35+
"1",
36+
"2",
37+
"3",
38+
"4",
39+
"5"
40+
],
41+
{
42+
"Ref": "BootstrapVersion"
43+
}
44+
]
45+
}
46+
]
47+
},
48+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
49+
}
50+
]
51+
}
52+
}
53+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-acls.js.snapshot/cdk.out

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"31.0.0"}

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-acls.js.snapshot/integ.json

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"version": "31.0.0",
3+
"testCases": {
4+
"integ-test/DefaultTest": {
5+
"stacks": [
6+
"Private",
7+
"BucketOwnerRead",
8+
"BucketOwnerFullControl"
9+
],
10+
"assertionStack": "integ-test/DefaultTest/DeployAssert",
11+
"assertionStackName": "integtestDefaultTestDeployAssert24D5C536"
12+
}
13+
}
14+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-acls.js.snapshot/integtestDefaultTestDeployAssert24D5C536.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "31.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "integtestDefaultTestDeployAssert24D5C536.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-acls.js.snapshot/integtestDefaultTestDeployAssert24D5C536.template.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

0 commit comments

Comments
 (0)