fix(s3): grantRead does not allow s3:HeadObject

aws · Oct 6, 2023 · 6f0a25d · 6f0a25d
1 parent c68ea44
commit 6f0a25d
Show file tree

Hide file tree

Showing 113 changed files with 200 additions and 14 deletions.
diff --git a/...k-integ/test/aws-codebuild/test/integ.caching.js.snapshot/aws-cdk-codebuild.template.json b/...k-integ/test/aws-codebuild/test/integ.caching.js.snapshot/aws-cdk-codebuild.template.json
@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...t-buildspec-artifacts.js.snapshot/aws-cdk-codebuild-buildspec-artifact-name.template.json b/...t-buildspec-artifacts.js.snapshot/aws-cdk-codebuild-buildspec-artifact-name.template.json
@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...sources-artifacts.js.snapshot/aws-cdk-codebuild-secondary-sources-artifacts.template.json b/...sources-artifacts.js.snapshot/aws-cdk-codebuild-secondary-sources-artifacts.template.json
@@ -63,6 +63,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...tions/test/cloudformation/integ.stacksets.js.snapshot/StackSetPipelineStack.template.json b/...tions/test/cloudformation/integ.stacksets.js.snapshot/StackSetPipelineStack.template.json
@@ -170,6 +170,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/....cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json b/....cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json
@@ -158,6 +158,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -433,6 +434,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...st/integ.lambda-deployed-through-codepipeline.lit.js.snapshot/PipelineStack.template.json b/...st/integ.lambda-deployed-through-codepipeline.lit.js.snapshot/PipelineStack.template.json
@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -497,6 +498,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -614,6 +616,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -1347,6 +1350,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -1558,6 +1562,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...-actions/test/integ.lambda-pipeline.js.snapshot/aws-cdk-codepipeline-lambda.template.json b/...-actions/test/integ.lambda-pipeline.js.snapshot/aws-cdk-codepipeline-lambda.template.json
@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...t/integ.pipeline-alexa-deploy.js.snapshot/aws-cdk-codepipeline-alexa-deploy.template.json b/...t/integ.pipeline-alexa-deploy.js.snapshot/aws-cdk-codepipeline-alexa-deploy.template.json
@@ -162,6 +162,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...n-cross-region.js.snapshot/aws-cdk-codepipeline-cloudformation-cross-region.template.json b/...n-cross-region.js.snapshot/aws-cdk-codepipeline-cloudformation-cross-region.template.json
@@ -38,6 +38,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/....snapshot/aws-cdk-codepipeline-cloudformation-cross-region-with-action-role.template.json b/....snapshot/aws-cdk-codepipeline-cloudformation-cross-region-with-action-role.template.json
@@ -163,6 +163,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...ons/test/integ.pipeline-cfn.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json b/...ons/test/integ.pipeline-cfn.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json
@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/....pipeline-code-build-batch.js.snapshot/aws-cdk-codepipeline-codebuild-batch.template.json b/....pipeline-code-build-batch.js.snapshot/aws-cdk-codepipeline-codebuild-batch.template.json
@@ -109,6 +109,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...-outputs.js.snapshot/aws-cdk-codepipeline-codebuild-multiple-inputs-outputs.template.json b/...-outputs.js.snapshot/aws-cdk-codepipeline-codebuild-multiple-inputs-outputs.template.json
@@ -109,6 +109,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -530,6 +531,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...ine-code-commit-build.js.snapshot/aws-cdk-codepipeline-codecommit-codebuild.template.json b/...ine-code-commit-build.js.snapshot/aws-cdk-codepipeline-codecommit-codebuild.template.json
@@ -91,6 +91,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -358,6 +359,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -614,6 +616,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...test/integ.pipeline-code-commit.js.snapshot/aws-cdk-codepipeline-codecommit.template.json b/...test/integ.pipeline-code-commit.js.snapshot/aws-cdk-codepipeline-codecommit.template.json
@@ -223,6 +223,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -431,6 +432,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...eg.pipeline-code-deploy-ecs.js.snapshot/aws-cdk-codepipeline-codedeploy-ecs.template.json b/...eg.pipeline-code-deploy-ecs.js.snapshot/aws-cdk-codepipeline-codedeploy-ecs.template.json
@@ -38,6 +38,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...test/integ.pipeline-code-deploy.js.snapshot/aws-cdk-codepipeline-codedeploy.template.json b/...test/integ.pipeline-code-deploy.js.snapshot/aws-cdk-codepipeline-codedeploy.template.json
@@ -112,6 +112,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/.../test/integ.pipeline-ecr-source.js.snapshot/aws-cdk-codepipeline-ecr-source.template.json b/.../test/integ.pipeline-ecr-source.js.snapshot/aws-cdk-codepipeline-ecr-source.template.json
@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/.../test/integ.pipeline-ecs-deploy.js.snapshot/aws-cdk-codepipeline-ecs-deploy.template.json b/.../test/integ.pipeline-ecs-deploy.js.snapshot/aws-cdk-codepipeline-ecs-deploy.template.json
@@ -444,6 +444,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -597,6 +598,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...e-ecs-separate-source.lit.js.snapshot/aws-cdk-pipeline-ecs-separate-sources.template.json b/...e-ecs-separate-source.lit.js.snapshot/aws-cdk-pipeline-ecs-separate-sources.template.json
@@ -384,6 +384,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -630,6 +631,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -943,6 +945,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -1044,6 +1047,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...-beanstalk-deploy.js.snapshot/aws-cdk-codepipeline-elastic-beanstalk-deploy.template.json b/...-beanstalk-deploy.js.snapshot/aws-cdk-codepipeline-elastic-beanstalk-deploy.template.json
@@ -270,6 +270,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -476,6 +477,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...ctions/test/integ.pipeline-events.js.snapshot/aws-cdk-pipeline-event-target.template.json b/...ctions/test/integ.pipeline-events.js.snapshot/aws-cdk-pipeline-event-target.template.json
@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -375,6 +376,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -766,6 +768,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...ctions/test/integ.pipeline-jenkins.js.snapshot/aws-cdk-codepipeline-jenkins.template.json b/...ctions/test/integ.pipeline-jenkins.js.snapshot/aws-cdk-codepipeline-jenkins.template.json
@@ -38,6 +38,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...g.pipeline-manual-approval.js.snapshot/aws-cdk-codepipeline-manual-approval.template.json b/...g.pipeline-manual-approval.js.snapshot/aws-cdk-codepipeline-manual-approval.template.json
@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...ns/test/integ.pipeline-s3-deploy.js.snapshot/aws-cdk-codepipeline-s3-deploy.template.json b/...ns/test/integ.pipeline-s3-deploy.js.snapshot/aws-cdk-codepipeline-s3-deploy.template.json
@@ -392,6 +392,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...integ.pipeline-stepfunctions.js.snapshot/aws-cdk-codepipeline-stepfunctions.template.json b/...integ.pipeline-stepfunctions.js.snapshot/aws-cdk-codepipeline-stepfunctions.template.json
@@ -186,6 +186,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...t/integ.pipeline-with-replication.js.snapshot/integ-pipeline-consumer-stack.template.json b/...t/integ.pipeline-with-replication.js.snapshot/integ-pipeline-consumer-stack.template.json
@@ -148,6 +148,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...3/integ.source-bucket-events-cross-stack-same-env.js.snapshot/PipelineStack.template.json b/...3/integ.source-bucket-events-cross-stack-same-env.js.snapshot/PipelineStack.template.json
@@ -355,6 +355,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...nteg/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/aws-ecs-integ.template.json b/...nteg/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/aws-ecs-integ.template.json
@@ -1291,6 +1291,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...s/test/codepipeline/integ.pipeline-event-target.js.snapshot/pipeline-events.template.json b/...s/test/codepipeline/integ.pipeline-event-target.js.snapshot/pipeline-events.template.json
@@ -158,6 +158,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...ose/integ.kinesis-firehose-stream.js.snapshot/aws-cdk-firehose-event-target.template.json b/...ose/integ.kinesis-firehose-stream.js.snapshot/aws-cdk-firehose-event-target.template.json
@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...k-integ/test/aws-rds/test/integ.cluster-s3.js.snapshot/aws-cdk-rds-s3-integ.template.json b/...k-integ/test/aws-rds/test/integ.cluster-s3.js.snapshot/aws-cdk-rds-s3-integ.template.json
@@ -550,6 +550,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...-rds/test/integ.cluster-s3.mysql-8.js.snapshot/aws-cdk-rds-s3-mysql-8-integ.template.json b/...-rds/test/integ.cluster-s3.mysql-8.js.snapshot/aws-cdk-rds-s3-mysql-8-integ.template.json
@@ -454,6 +454,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...teg.instance-s3-postgres.js.snapshot/aws-cdk-rds-instance-s3-postgres-integ.template.json b/...teg.instance-s3-postgres.js.snapshot/aws-cdk-rds-instance-s3-postgres-integ.template.json
@@ -486,6 +486,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",