test-helper/acl-migrate/check-aws.sh

#!/bin/bash -x

source ./env

# check public read-write bucket with object inside
aws s3api get-bucket-acl --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-public-rw --endpoint $S3ENDPOINT || exit 1
aws s3api get-object-acl --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-public-rw --endpoint $S3ENDPOINT --key $S3KEY || exit 1
aws s3api get-object --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-public-rw --endpoint $S3ENDPOINT --key $S3KEY out || exit 1                 # allow owner to get object
aws s3api put-object --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-public-rw --endpoint $S3ENDPOINT --key $S3KEY-new --body $FILE || exit 1    # allow owner to put object
aws s3api get-object --no-verify-ssl --profile $S3PROFEXT --bucket $S3PREFIX-public-rw --endpoint $S3ENDPOINT --key $S3KEY out || exit 1              # allow others to get object
aws s3api put-object --no-verify-ssl --profile $S3PROFEXT --bucket $S3PREFIX-public-rw --endpoint $S3ENDPOINT --key $S3KEY-new --body $FILE || exit 1 # allow others to put object

# check public read bucket with object inside
aws s3api get-bucket-acl --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-public-r --endpoint $S3ENDPOINT || exit 1
aws s3api get-object-acl --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-public-r --endpoint $S3ENDPOINT --key $S3KEY || exit 1
aws s3api get-object --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-public-r --endpoint $S3ENDPOINT --key $S3KEY out || exit 1                 # allow owner to get object
aws s3api put-object --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-public-r --endpoint $S3ENDPOINT --key $S3KEY-new --body $FILE || exit 1    # allow owner to put object
aws s3api get-object --no-verify-ssl --profile $S3PROFEXT --bucket $S3PREFIX-public-r --endpoint $S3ENDPOINT --key $S3KEY out || exit 1              # allow others to get object
aws s3api put-object --no-verify-ssl --profile $S3PROFEXT --bucket $S3PREFIX-public-r --endpoint $S3ENDPOINT --key $S3KEY-new --body $FILE && exit 1 # deny others to put object

# check private read bucket with object inside
aws s3api get-bucket-acl --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-private --endpoint $S3ENDPOINT || exit 1
aws s3api get-object-acl --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-private --endpoint $S3ENDPOINT --key $S3KEY || exit 1
aws s3api get-object --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-private --endpoint $S3ENDPOINT --key $S3KEY out || exit 1                 # allow owner to get object
aws s3api put-object --no-verify-ssl --profile $S3PROF --bucket $S3PREFIX-private --endpoint $S3ENDPOINT --key $S3KEY-new --body $FILE || exit 1    # allow owner to put object
aws s3api get-object --no-verify-ssl --profile $S3PROFEXT --bucket $S3PREFIX-private --endpoint $S3ENDPOINT --key $S3KEY out && exit 1              # deny others to get object
aws s3api put-object --no-verify-ssl --profile $S3PROFEXT --bucket $S3PREFIX-private --endpoint $S3ENDPOINT --key $S3KEY-new --body $FILE && exit 1 # deny others to put object

rm out && exit 0