aws-s3: grantPut not working as advertised

[PhilKershaw]

The grantPut method documentation reads:

Grants s3:PutObject* and s3:Abort* permissions for this bucket to an IAM principal.

If encryption is used, permission to use the key to encrypt the contents of written files will also be granted to the same principal.

Reproduction Steps

const function = new lambda.Function(this, "FunkyTown", {...});
const bucket = new s3.Bucket(this, "AWholeLotOfBucket");
bucket.grantPut(function);

What did you expect to happen?

To add action s3:PutObject* thus:

Action:
  - s3:PutObject*
  - s3:Abort*
Effect: Allow
Resource:
  Fn::Join:
    - ""
    - - Fn::GetAtt:
          - AWholeLotOfBucketA765543B
          - Arn
      - /*

What actually happened?

Action:
  - s3:PutObject
  - s3:Abort*
Effect: Allow
Resource:
  Fn::Join:
    - ""
    - - Fn::GetAtt:
          - AWholeLotOfBucketA765543B
          - Arn
      - /*

Environment

• **CDK CLI Version : 1.93.0
• **Framework Version: 1.93.0
• **Node.js Version: v14.16.0
• **OS : Amazon Linux release 2 (Karoo)
• **Language (Version): 3.9.9

Other

Link to docs: https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-s3.Bucket.html#grantwbrputidentity-objectskeypattern
Link to original PR: #591

---

This is 🐛 Bug Report

[iliapolo]

@PhilKershaw Thanks. Yes we recently changed this behavior. We'll fix the docs.

[PhilKershaw]

Ah, I was actually hoping for the code to be aligned to the docs. Otherwise, there's no other convenient way to grant PutObjectTagging or any other PutObject* action.

[iliapolo]

@PhilKershaw We decided against using * because it winds up granting PubObjectAcl - which is undesirable in most cases.

You can have a look at this PR for more context.

[PhilKershaw]

In which case it would be nice to have convenient methods for Tagging etc.. for PutObject like PutObjectAcl - are they on the roadmap? In the meantime, I'll stop being lazy and write the proper policies.

[iliapolo]

We don't currently have a request for those policies. But you are welcome to be the first to make it :)

[demauk]

I agree that PutObject* is too permissive. On the other hand, I would expect grantPut() to allow tagging.

The same issue exists with grantWrite() and grantReadWrite().

Surely 'PutObject', 'PutObjectTagging' would be ok? May follow up with a PR when time permits.

[flavioleggio]

I am facing with the same issue now, upgrading my cdk lib version. Wouldn't it be better to just explicitly exclude the PutObjectAcl action with a deny effect on the policy instead of removing all PutObject* related acions?

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.