import allure import pytest from frostfs_testlib import reporter from frostfs_testlib.s3 import AwsCliClient, Boto3ClientWrapper, S3ClientWrapper from frostfs_testlib.steps.s3 import s3_helper from frostfs_testlib.storage.dataclasses.object_size import ObjectSize from frostfs_testlib.utils.file_utils import generate_file @pytest.mark.acl @pytest.mark.s3_gate class TestS3GateACL: @allure.title("Object ACL (s3_client={s3_client})") @pytest.mark.parametrize("s3_client", [AwsCliClient], indirect=True) def test_s3_object_ACL(self, s3_client: S3ClientWrapper, bucket: str, simple_object_size: ObjectSize): file_path = generate_file(simple_object_size.value) file_name = s3_helper.object_key_from_file_path(file_path) with reporter.step("Put object into bucket, Check ACL is empty"): s3_client.put_object(bucket, file_path) obj_acl = s3_client.get_object_acl(bucket, file_name) assert obj_acl == [], f"Expected ACL is empty, got {obj_acl}" with reporter.step("Put object ACL = public-read"): s3_client.put_object_acl(bucket, file_name, "public-read") obj_acl = s3_client.get_object_acl(bucket, file_name) s3_helper.assert_s3_acl(acl_grants=obj_acl, permitted_users="AllUsers") with reporter.step("Put object ACL = private"): s3_client.put_object_acl(bucket, file_name, "private") obj_acl = s3_client.get_object_acl(bucket, file_name) s3_helper.assert_s3_acl(acl_grants=obj_acl, permitted_users="CanonicalUser") with reporter.step("Put object with grant-read uri=http://acs.amazonaws.com/groups/global/AllUsers"): s3_client.put_object_acl( bucket, file_name, grant_read="uri=http://acs.amazonaws.com/groups/global/AllUsers", ) obj_acl = s3_client.get_object_acl(bucket, file_name) s3_helper.assert_s3_acl(acl_grants=obj_acl, permitted_users="AllUsers") @allure.title("Bucket ACL (s3_client={s3_client})") @pytest.mark.parametrize("s3_client", [AwsCliClient, Boto3ClientWrapper], indirect=True) def test_s3_bucket_ACL(self, s3_client: S3ClientWrapper): with reporter.step("Create bucket with ACL = public-read-write"): bucket = s3_client.create_bucket(object_lock_enabled_for_bucket=True, acl="public-read-write") bucket_acl = s3_client.get_bucket_acl(bucket) s3_helper.assert_s3_acl(acl_grants=bucket_acl, permitted_users="AllUsers") with reporter.step("Change bucket ACL to private"): s3_client.put_bucket_acl(bucket, acl="private") bucket_acl = s3_client.get_bucket_acl(bucket) s3_helper.assert_s3_acl(acl_grants=bucket_acl, permitted_users="CanonicalUser") with reporter.step("Change bucket acl to --grant-write uri=http://acs.amazonaws.com/groups/global/AllUsers"): s3_client.put_bucket_acl( bucket, grant_write="uri=http://acs.amazonaws.com/groups/global/AllUsers", ) bucket_acl = s3_client.get_bucket_acl(bucket) s3_helper.assert_s3_acl(acl_grants=bucket_acl, permitted_users="AllUsers")