fix(s3): grantRead does not allow s3:HeadObject (#27416)

Fixes the policy enforced by `grantRead` to allow operations that require to read an object's metadata, for example: ``` s3 = boto3.client("s3") # this operation requires s3:HeadObject permission s3.download_file(bucket, key, filepath) ``` Closes #27389. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
aws · Oct 11, 2023 · beac675 · beac675
1 parent 3fc86ca
commit beac675
Show file tree

Hide file tree

Showing 124 changed files with 299 additions and 14 deletions.
diff --git a/...ebuild/test/integ.asset-build-spec.js.snapshot/CodeBuildAssetBuildSpecStack.template.json b/...ebuild/test/integ.asset-build-spec.js.snapshot/CodeBuildAssetBuildSpecStack.template.json
@@ -26,6 +26,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...k-integ/test/aws-codebuild/test/integ.caching.js.snapshot/aws-cdk-codebuild.template.json b/...k-integ/test/aws-codebuild/test/integ.caching.js.snapshot/aws-cdk-codebuild.template.json
@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/.../test/aws-codebuild/test/integ.project-bucket.js.snapshot/aws-cdk-codebuild.template.json b/.../test/aws-codebuild/test/integ.project-bucket.js.snapshot/aws-cdk-codebuild.template.json
@@ -31,6 +31,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...t-buildspec-artifacts.js.snapshot/aws-cdk-codebuild-buildspec-artifact-name.template.json b/...t-buildspec-artifacts.js.snapshot/aws-cdk-codebuild-buildspec-artifact-name.template.json
@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...sources-artifacts.js.snapshot/aws-cdk-codebuild-secondary-sources-artifacts.template.json b/...sources-artifacts.js.snapshot/aws-cdk-codebuild-secondary-sources-artifacts.template.json
@@ -31,6 +31,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -63,6 +64,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...test/server/integ.deployment-group.js.snapshot/aws-cdk-codedeploy-server-dg.template.json b/...test/server/integ.deployment-group.js.snapshot/aws-cdk-codedeploy-server-dg.template.json
@@ -445,6 +445,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...tions/test/cloudformation/integ.stacksets.js.snapshot/StackSetPipelineStack.template.json b/...tions/test/cloudformation/integ.stacksets.js.snapshot/StackSetPipelineStack.template.json
@@ -170,6 +170,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -392,6 +393,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -556,6 +558,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/....cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json b/....cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json
@@ -158,6 +158,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -433,6 +434,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -558,6 +560,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -668,6 +671,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...st/integ.lambda-deployed-through-codepipeline.lit.js.snapshot/PipelineStack.template.json b/...st/integ.lambda-deployed-through-codepipeline.lit.js.snapshot/PipelineStack.template.json
@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -497,6 +498,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -614,6 +616,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -923,6 +926,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -1031,6 +1035,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -1347,6 +1352,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -1558,6 +1564,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...-actions/test/integ.lambda-pipeline.js.snapshot/aws-cdk-codepipeline-lambda.template.json b/...-actions/test/integ.lambda-pipeline.js.snapshot/aws-cdk-codepipeline-lambda.template.json
@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -360,6 +361,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...t/integ.pipeline-alexa-deploy.js.snapshot/aws-cdk-codepipeline-alexa-deploy.template.json b/...t/integ.pipeline-alexa-deploy.js.snapshot/aws-cdk-codepipeline-alexa-deploy.template.json
@@ -162,6 +162,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -361,6 +362,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...n-cross-region.js.snapshot/aws-cdk-codepipeline-cloudformation-cross-region.template.json b/...n-cross-region.js.snapshot/aws-cdk-codepipeline-cloudformation-cross-region.template.json
@@ -38,6 +38,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -233,6 +234,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -351,6 +353,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -438,6 +441,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/....snapshot/aws-cdk-codepipeline-cloudformation-cross-region-with-action-role.template.json b/....snapshot/aws-cdk-codepipeline-cloudformation-cross-region-with-action-role.template.json
@@ -66,6 +66,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -163,6 +164,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -356,6 +358,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -453,6 +456,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...ons/test/integ.pipeline-cfn.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json b/...ons/test/integ.pipeline-cfn.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json
@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -408,6 +409,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -535,6 +537,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -672,6 +675,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/....pipeline-code-build-batch.js.snapshot/aws-cdk-codepipeline-codebuild-batch.template.json b/....pipeline-code-build-batch.js.snapshot/aws-cdk-codepipeline-codebuild-batch.template.json
@@ -109,6 +109,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -425,6 +426,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...-outputs.js.snapshot/aws-cdk-codepipeline-codebuild-multiple-inputs-outputs.template.json b/...-outputs.js.snapshot/aws-cdk-codepipeline-codebuild-multiple-inputs-outputs.template.json
@@ -109,6 +109,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -170,6 +171,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -530,6 +532,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...ine-code-commit-build.js.snapshot/aws-cdk-codepipeline-codecommit-codebuild.template.json b/...ine-code-commit-build.js.snapshot/aws-cdk-codepipeline-codecommit-codebuild.template.json
@@ -91,6 +91,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -358,6 +359,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -614,6 +616,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...test/integ.pipeline-code-commit.js.snapshot/aws-cdk-codepipeline-codecommit.template.json b/...test/integ.pipeline-code-commit.js.snapshot/aws-cdk-codepipeline-codecommit.template.json
@@ -223,6 +223,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -431,6 +432,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...eg.pipeline-code-deploy-ecs.js.snapshot/aws-cdk-codepipeline-codedeploy-ecs.template.json b/...eg.pipeline-code-deploy-ecs.js.snapshot/aws-cdk-codepipeline-codedeploy-ecs.template.json
@@ -38,6 +38,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -230,6 +231,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -438,6 +440,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",