-
Notifications
You must be signed in to change notification settings - Fork 1.2k
fix: bucket exists check for session.default_bucket #3165
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: bucket exists check for session.default_bucket #3165
Conversation
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
Codecov Report
@@ Coverage Diff @@
## master #3165 +/- ##
==========================================
- Coverage 89.63% 89.63% -0.01%
==========================================
Files 200 200
Lines 17391 17399 +8
==========================================
+ Hits 15588 15595 +7
- Misses 1803 1804 +1
Continue to review full report at Codecov.
|
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
Thank you @mufaddal-rohawala for writing such a clear description of the problem and for linking the PR issue |
Issue #, if available:
#2910
#1990
Description of changes:
Current check for bucket existence in
session.py
requiress3:ListAllMyBuckets
. This permission shouldn't be necessary and is often not allowed in environments following the least privileges principle. Also Withouts3:ListAllMyBuckets
permissions the case of bucket existence, still requiress3:CreateBucket
perms otherwise the check doesn't work properly.Expected behavior
Users should be able to create a Sagemaker jobs without having to assign s3:ListAllMyBuckets or s3:CreateBucket to the IAM role.
With this change users can now use a
s3:ListBucket
on a specific bucket, which can support the case of same or cross account specific bucket access.Testing done:
For backwards compatibility the creation_date check for
s3:ListAllMyBuckets
would also be supported.Added units
Merge Checklist
Put an
x
in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask. We're here to help! This is simply a reminder of what we are going to look for before merging your pull request.General
Tests
unique_name_from_base
to create resource names in integ tests (if appropriate)By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.