Extend bucket policy support #32

New issue

Closed

opened 2023-02-16 13:06:00 +00:00 by KirillovDenis · 1 comment

KirillovDenis commented

2023-02-16 13:06:00 +00:00

(Migrated from github.com)

Currently we expects that Statement.Action and Statement.Resources (in bucket policy) be string array as more general case.

{
    "Version": "2012-10-17",
    "Statement": [{
        "Principal":{
            "AWS":[
                "arn:aws:iam::111122223333:role/JohnDoe"
            ]
        },
        "Effect": "Allow",
        "Action": [
            "s3:PutObjectTagging"
        ],
        "Resource": [
            "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"
        ],
        "Condition": {
            "ForAnyValue:StringEquals": {
                "s3:RequestObjectTagKeys": [
                    "Owner",
                    "CreationDate"
                ]
            }
        }
    }
  ]
}

But we should support and more particular case:

{
    "Version": "2012-10-17",
    "Id": "PutObjPolicy",
    "Statement": [{
        "Sid": "DenyObjectsThatAreNotSSEKMS",
        "Principal": "*",
        "Effect": "Deny",
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
        "Condition": {
            "Null": {
                "s3:x-amz-server-side-encryption-aws-kms-key-id": "true"
            }
        }
    }]
}

Currently we expects that `Statement.Action` and `Statement.Resources` (in [bucket policy](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html)) be string array as more general case. ```json { "Version": "2012-10-17", "Statement": [{ "Principal":{ "AWS":[ "arn:aws:iam::111122223333:role/JohnDoe" ] }, "Effect": "Allow", "Action": [ "s3:PutObjectTagging" ], "Resource": [ "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*" ], "Condition": { "ForAnyValue:StringEquals": { "s3:RequestObjectTagKeys": [ "Owner", "CreationDate" ] } } } ] } ``` But we should support and more particular case: ```json { "Version": "2012-10-17", "Id": "PutObjPolicy", "Statement": [{ "Sid": "DenyObjectsThatAreNotSSEKMS", "Principal": "*", "Effect": "Deny", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*", "Condition": { "Null": { "s3:x-amz-server-side-encryption-aws-kms-key-id": "true" } } }] } ```