Skip to content

Commit 5b5c36f

Browse files
lpizzinidevlpizzinidev
authored
feat(s3): add allowedActionPatterns parameter to grantWrite (#24211)
I've added an optional parameter `allowedActionPatterns` that will restrict the permissions to a certain list of action patterns for the `grantWrite` method. Closes #24074 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent cdfa970 commit 5b5c36f

11 files changed

+590
-3
lines changed

‎packages/@aws-cdk/aws-s3/lib/bucket.ts

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -204,8 +204,9 @@ export interface IBucket extends IResource {
204204
*
205205
* @param identity The principal
206206
* @param objectsKeyPattern Restrict the permission to a certain key pattern (default '*')
207+
* @param allowedActionPatterns Restrict the permissions to certain list of action patterns
207208
*/
208-
grantWrite(identity: iam.IGrantable, objectsKeyPattern?: any): iam.Grant;
209+
grantWrite(identity: iam.IGrantable, objectsKeyPattern?: any, allowedActionPatterns?: string[]): iam.Grant;
209210

210211
/**
211212
* Grants s3:PutObject* and s3:Abort* permissions for this bucket to an IAM principal.
@@ -771,8 +772,9 @@ export abstract class BucketBase extends Resource implements IBucket {
771772
this.arnForObjects(objectsKeyPattern));
772773
}
773774

774-
public grantWrite(identity: iam.IGrantable, objectsKeyPattern: any = '*') {
775-
return this.grant(identity, this.writeActions, perms.KEY_WRITE_ACTIONS,
775+
public grantWrite(identity: iam.IGrantable, objectsKeyPattern: any = '*', allowedActionPatterns: string[] = []) {
776+
const grantedWriteActions = allowedActionPatterns.length > 0 ? allowedActionPatterns : this.writeActions;
777+
return this.grant(identity, grantedWriteActions, perms.KEY_WRITE_ACTIONS,
776778
this.bucketArn,
777779
this.arnForObjects(objectsKeyPattern));
778780
}

‎packages/@aws-cdk/aws-s3/test/bucket.test.ts

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1455,6 +1455,37 @@ describe('bucket', () => {
14551455
},
14561456
});
14571457
});
1458+
1459+
test('grant only allowedActionPatterns when specified', () => {
1460+
const stack = new cdk.Stack();
1461+
const bucket = new s3.Bucket(stack, 'MyBucket');
1462+
const user = new iam.User(stack, 'MyUser');
1463+
1464+
bucket.grantWrite(user, '*', ['s3:PutObject', 's3:DeleteObject*']);
1465+
1466+
Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
1467+
'PolicyDocument': {
1468+
'Statement': [
1469+
{
1470+
'Action': [
1471+
's3:PutObject',
1472+
's3:DeleteObject*',
1473+
],
1474+
'Effect': 'Allow',
1475+
'Resource': [
1476+
{ 'Fn::GetAtt': ['MyBucketF68F3FF0', 'Arn'] },
1477+
{
1478+
'Fn::Join': ['', [
1479+
{ 'Fn::GetAtt': ['MyBucketF68F3FF0', 'Arn'] },
1480+
'/*',
1481+
]],
1482+
},
1483+
],
1484+
},
1485+
],
1486+
},
1487+
});
1488+
});
14581489
});
14591490

14601491
describe('grantPut', () => {

‎packages/@aws-cdk/aws-s3/test/integ.bucket-grant-write.js.snapshot/BucketGrantWriteTestDefaultTestDeployAssertF3318F24.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "30.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "BucketGrantWriteTestDefaultTestDeployAssertF3318F24.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-s3/test/integ.bucket-grant-write.js.snapshot/BucketGrantWriteTestDefaultTestDeployAssertF3318F24.template.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk/aws-s3/test/integ.bucket-grant-write.js.snapshot/aws-cdk-s3.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "30.0.0",
3+
"files": {
4+
"34e0a1e6ce9d1aa5b00cd8325cf0dbe5e3f48e12033dd7ac3cdfa0c604491edf": {
5+
"source": {
6+
"path": "aws-cdk-s3.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "34e0a1e6ce9d1aa5b00cd8325cf0dbe5e3f48e12033dd7ac3cdfa0c604491edf.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-s3/test/integ.bucket-grant-write.js.snapshot/aws-cdk-s3.template.json

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
{
2+
"Resources": {
3+
"MyBucketF68F3FF0": {
4+
"Type": "AWS::S3::Bucket",
5+
"Properties": {
6+
"BucketEncryption": {
7+
"ServerSideEncryptionConfiguration": [
8+
{
9+
"ServerSideEncryptionByDefault": {
10+
"SSEAlgorithm": "AES256"
11+
}
12+
}
13+
]
14+
}
15+
},
16+
"UpdateReplacePolicy": "Delete",
17+
"DeletionPolicy": "Delete"
18+
},
19+
"MyUserDC45028B": {
20+
"Type": "AWS::IAM::User"
21+
},
22+
"MyUserDefaultPolicy7B897426": {
23+
"Type": "AWS::IAM::Policy",
24+
"Properties": {
25+
"PolicyDocument": {
26+
"Statement": [
27+
{
28+
"Action": [
29+
"s3:DeleteObject*",
30+
"s3:PutObject"
31+
],
32+
"Effect": "Allow",
33+
"Resource": [
34+
{
35+
"Fn::GetAtt": [
36+
"MyBucketF68F3FF0",
37+
"Arn"
38+
]
39+
},
40+
{
41+
"Fn::Join": [
42+
"",
43+
[
44+
{
45+
"Fn::GetAtt": [
46+
"MyBucketF68F3FF0",
47+
"Arn"
48+
]
49+
},
50+
"/*"
51+
]
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"Version": "2012-10-17"
58+
},
59+
"PolicyName": "MyUserDefaultPolicy7B897426",
60+
"Users": [
61+
{
62+
"Ref": "MyUserDC45028B"
63+
}
64+
]
65+
}
66+
}
67+
},
68+
"Parameters": {
69+
"BootstrapVersion": {
70+
"Type": "AWS::SSM::Parameter::Value<String>",
71+
"Default": "/cdk-bootstrap/hnb659fds/version",
72+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
73+
}
74+
},
75+
"Rules": {
76+
"CheckBootstrapVersion": {
77+
"Assertions": [
78+
{
79+
"Assert": {
80+
"Fn::Not": [
81+
{
82+
"Fn::Contains": [
83+
[
84+
"1",
85+
"2",
86+
"3",
87+
"4",
88+
"5"
89+
],
90+
{
91+
"Ref": "BootstrapVersion"
92+
}
93+
]
94+
}
95+
]
96+
},
97+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
98+
}
99+
]
100+
}
101+
}
102+
}

‎packages/@aws-cdk/aws-s3/test/integ.bucket-grant-write.js.snapshot/cdk.out

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"30.0.0"}

‎packages/@aws-cdk/aws-s3/test/integ.bucket-grant-write.js.snapshot/integ.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "30.0.0",
3+
"testCases": {
4+
"BucketGrantWriteTest/DefaultTest": {
5+
"stacks": [
6+
"aws-cdk-s3"
7+
],
8+
"assertionStack": "BucketGrantWriteTest/DefaultTest/DeployAssert",
9+
"assertionStackName": "BucketGrantWriteTestDefaultTestDeployAssertF3318F24"
10+
}
11+
}
12+
}

‎packages/@aws-cdk/aws-s3/test/integ.bucket-grant-write.js.snapshot/manifest.json

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
{
2+
"version": "30.0.0",
3+
"artifacts": {
4+
"aws-cdk-s3.assets": {
5+
"type": "cdk:asset-manifest",
6+
"properties": {
7+
"file": "aws-cdk-s3.assets.json",
8+
"requiresBootstrapStackVersion": 6,
9+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
10+
}
11+
},
12+
"aws-cdk-s3": {
13+
"type": "aws:cloudformation:stack",
14+
"environment": "aws://unknown-account/unknown-region",
15+
"properties": {
16+
"templateFile": "aws-cdk-s3.template.json",
17+
"validateOnSynth": false,
18+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
19+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/34e0a1e6ce9d1aa5b00cd8325cf0dbe5e3f48e12033dd7ac3cdfa0c604491edf.json",
21+
"requiresBootstrapStackVersion": 6,
22+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
23+
"additionalDependencies": [
24+
"aws-cdk-s3.assets"
25+
],
26+
"lookupRole": {
27+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
28+
"requiresBootstrapStackVersion": 8,
29+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
30+
}
31+
},
32+
"dependencies": [
33+
"aws-cdk-s3.assets"
34+
],
35+
"metadata": {
36+
"/aws-cdk-s3/MyBucket/Resource": [
37+
{
38+
"type": "aws:cdk:logicalId",
39+
"data": "MyBucketF68F3FF0"
40+
}
41+
],
42+
"/aws-cdk-s3/MyUser/Resource": [
43+
{
44+
"type": "aws:cdk:logicalId",
45+
"data": "MyUserDC45028B"
46+
}
47+
],
48+
"/aws-cdk-s3/MyUser/DefaultPolicy/Resource": [
49+
{
50+
"type": "aws:cdk:logicalId",
51+
"data": "MyUserDefaultPolicy7B897426"
52+
}
53+
],
54+
"/aws-cdk-s3/BootstrapVersion": [
55+
{
56+
"type": "aws:cdk:logicalId",
57+
"data": "BootstrapVersion"
58+
}
59+
],
60+
"/aws-cdk-s3/CheckBootstrapVersion": [
61+
{
62+
"type": "aws:cdk:logicalId",
63+
"data": "CheckBootstrapVersion"
64+
}
65+
]
66+
},
67+
"displayName": "aws-cdk-s3"
68+
},
69+
"BucketGrantWriteTestDefaultTestDeployAssertF3318F24.assets": {
70+
"type": "cdk:asset-manifest",
71+
"properties": {
72+
"file": "BucketGrantWriteTestDefaultTestDeployAssertF3318F24.assets.json",
73+
"requiresBootstrapStackVersion": 6,
74+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
75+
}
76+
},
77+
"BucketGrantWriteTestDefaultTestDeployAssertF3318F24": {
78+
"type": "aws:cloudformation:stack",
79+
"environment": "aws://unknown-account/unknown-region",
80+
"properties": {
81+
"templateFile": "BucketGrantWriteTestDefaultTestDeployAssertF3318F24.template.json",
82+
"validateOnSynth": false,
83+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
84+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
85+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
86+
"requiresBootstrapStackVersion": 6,
87+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
88+
"additionalDependencies": [
89+
"BucketGrantWriteTestDefaultTestDeployAssertF3318F24.assets"
90+
],
91+
"lookupRole": {
92+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
93+
"requiresBootstrapStackVersion": 8,
94+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
95+
}
96+
},
97+
"dependencies": [
98+
"BucketGrantWriteTestDefaultTestDeployAssertF3318F24.assets"
99+
],
100+
"metadata": {
101+
"/BucketGrantWriteTest/DefaultTest/DeployAssert/BootstrapVersion": [
102+
{
103+
"type": "aws:cdk:logicalId",
104+
"data": "BootstrapVersion"
105+
}
106+
],
107+
"/BucketGrantWriteTest/DefaultTest/DeployAssert/CheckBootstrapVersion": [
108+
{
109+
"type": "aws:cdk:logicalId",
110+
"data": "CheckBootstrapVersion"
111+
}
112+
]
113+
},
114+
"displayName": "BucketGrantWriteTest/DefaultTest/DeployAssert"
115+
},
116+
"Tree": {
117+
"type": "cdk:tree",
118+
"properties": {
119+
"file": "tree.json"
120+
}
121+
}
122+
}
123+
}

0 commit comments

Comments
 (0)