{ "$schema": "../schema/vector.schema.json", "vectors": [ { "id": "acl-0001", "group": "acl", "kind": "api", "title": "Canned ACL public-read at create then PutBucketAcl private resets grants to owner FULL_CONTROL only", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3997", "steps": [ { "$operation": { "name": "CreateBucket", "params": { "Bucket": "s3v-ceph-acl-bucket-canned", "ACL": "public-read" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-acl-bucket-canned" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "READ", "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AllUsers", "ID": { "$absent": true }, "DisplayName": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-acl-bucket-canned" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "s3v-ceph-acl-bucket-canned", "ACL": "private" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-acl-bucket-canned" }, "expect": { "response": { "Grants": [ { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } ] } } } } ] }, { "id": "acl-0002", "group": "acl", "kind": "api", "title": "Canned ACL authenticated-read at create grants READ to AuthenticatedUsers plus owner FULL_CONTROL", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4086", "steps": [ { "$operation": { "name": "CreateBucket", "params": { "Bucket": "s3v-ceph-acl-bucket-canned-authread", "ACL": "authenticated-read" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-acl-bucket-canned-authread" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "READ", "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AuthenticatedUsers", "ID": { "$absent": true }, "DisplayName": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-acl-bucket-canned-authread" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } } ] }, { "id": "acl-0003", "group": "acl", "kind": "api", "title": "CreateBucket with canned ACL public-read grants READ to AllUsers plus owner FULL_CONTROL", "tags": [ "tier-3", "acl", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3965", "steps": [ { "$operation": { "name": "CreateBucket", "params": { "Bucket": "s3v-ceph-acl-bucket-canned-during-create", "ACL": "public-read" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-acl-bucket-canned-during-create" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "READ", "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AllUsers", "ID": { "$absent": true }, "DisplayName": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-acl-bucket-canned-during-create" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } } ] }, { "id": "acl-0004", "group": "acl", "kind": "api", "title": "PutBucketAcl private on an already-private bucket succeeds with 200", "tags": [ "tier-3", "acl", "source:ceph-s3-tests", "source:msst-s3" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4503", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" }, "expect": { "status": 200 } } } ] }, { "id": "acl-0005", "group": "acl", "kind": "api", "title": "Canned ACL public-read-write at create grants READ and WRITE to AllUsers plus owner FULL_CONTROL", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4047", "steps": [ { "$operation": { "name": "CreateBucket", "params": { "Bucket": "s3v-ceph-acl-bucket-canned-prw", "ACL": "public-read-write" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-acl-bucket-canned-prw" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" }, "expect": { "response": { "Grants": { "$length": 3, "$contains": { "Permission": "READ", "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AllUsers", "ID": { "$absent": true }, "DisplayName": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-acl-bucket-canned-prw" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "WRITE", "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AllUsers", "ID": { "$absent": true }, "DisplayName": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-acl-bucket-canned-prw" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } } ] }, { "id": "acl-0006", "group": "acl", "kind": "api", "title": "Default bucket ACL is a single FULL_CONTROL grant to the bucket owner", "description": "The source test compares Owner/grantee against configured main-user identity; here the owner identity is captured from GetBucketAcl and the grant list is asserted against it.", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3937", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" }, "expect": { "response": { "Grants": { "$length": 1 } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" }, "Grants": [ { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } ] } } } } ] }, { "id": "acl-0007", "group": "acl", "kind": "api", "title": "PutBucketAcl granting by a nonexistent email address returns UnresolvableGrantByEmailAddress", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5002", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" }, { "Grantee": { "EmailAddress": "doesnotexist@dreamhost.com.invalid", "Type": "AmazonCustomerByEmail" }, "Permission": "FULL_CONTROL" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } }, "expect": { "status": 400, "error": "UnresolvableGrantByEmailAddress" } } } ] }, { "id": "acl-0008", "group": "acl", "kind": "api", "title": "PutBucketAcl granting to a nonexistent canonical user ID returns InvalidArgument", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4776", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" }, { "Grantee": { "ID": "_foo", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } }, "expect": { "status": 400, "error": "InvalidArgument" } } } ] }, { "id": "acl-0009", "group": "acl", "kind": "api", "title": "Bucket ACL user grant FULL_CONTROL lets the grantee read, read ACL, write and write ACL; owner is unchanged", "tags": [ "tier-3", "acl", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4699", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" }, { "Grantee": { "ID": "${res.alt.canonicalId}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "HeadBucket", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt" } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt" } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo-write", "Body": "bar" }, "identity": "alt" } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" }, "identity": "alt" } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } } ] }, { "id": "acl-0010", "group": "acl", "kind": "api", "title": "Bucket ACL user grant READ lets the grantee read the bucket but not read ACL, write, or write ACL", "tags": [ "tier-3", "acl", "errors", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4724", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" }, { "Grantee": { "ID": "${res.alt.canonicalId}", "Type": "CanonicalUser" }, "Permission": "READ" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "READ", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "HeadBucket", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt" } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo-write", "Body": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0011", "group": "acl", "kind": "api", "title": "Bucket ACL user grant READ_ACP lets the grantee read the ACL but not read, write, or write ACL", "tags": [ "tier-3", "acl", "errors", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4737", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" }, { "Grantee": { "ID": "${res.alt.canonicalId}", "Type": "CanonicalUser" }, "Permission": "READ_ACP" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "READ_ACP", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "HeadBucket", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt" } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo-write", "Body": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0012", "group": "acl", "kind": "api", "title": "Bucket ACL user grant WRITE lets the grantee write objects but not read, read ACL, or write ACL", "tags": [ "tier-3", "acl", "errors", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4751", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" }, { "Grantee": { "ID": "${res.alt.canonicalId}", "Type": "CanonicalUser" }, "Permission": "WRITE" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "WRITE", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "HeadBucket", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo-write", "Body": "bar" }, "identity": "alt" } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0013", "group": "acl", "kind": "api", "title": "Bucket ACL user grant WRITE_ACP lets the grantee write the ACL but not read, read ACL, or write objects", "tags": [ "tier-3", "acl", "errors", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4764", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" }, { "Grantee": { "ID": "${res.alt.canonicalId}", "Type": "CanonicalUser" }, "Permission": "WRITE_ACP" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "WRITE_ACP", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "HeadBucket", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo-write", "Body": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" }, "identity": "alt" } } ] }, { "id": "acl-0014", "group": "acl", "kind": "api", "title": "PutBucketAcl with an empty grant list revokes all grants including the owner's", "description": "The final step restores the owner FULL_CONTROL grant, mirroring the source test's restore so the bucket can be cleaned up.", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5021", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "bar" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "AccessControlPolicy": { "Grants": [], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": [] } } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } } ] }, { "id": "acl-0015", "group": "acl", "kind": "api", "title": "PutObjectAcl replacing the owner grant with FULL_CONTROL reads back the same single grant", "tags": [ "tier-3", "acl", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4572", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "bar" } } ], "steps": [ { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": [ { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } ] } } } } ] }, { "id": "acl-0016", "group": "acl", "kind": "api", "title": "Object canned ACL public-read then PutObjectAcl private resets grants to owner FULL_CONTROL only", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4213", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "bar", "ACL": "public-read" } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "READ", "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AllUsers", "ID": { "$absent": true }, "DisplayName": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "private" } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": [ { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } ] } } } } ] }, { "id": "acl-0017", "group": "acl", "kind": "api", "title": "PutObject with canned ACL authenticated-read grants READ to AuthenticatedUsers plus owner FULL_CONTROL", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4307", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "bar", "ACL": "authenticated-read" } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "READ", "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AuthenticatedUsers", "ID": { "$absent": true }, "DisplayName": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } } ] }, { "id": "acl-0018", "group": "acl", "kind": "api", "title": "Canned ACL bucket-owner-full-control on an alt-owned object grants FULL_CONTROL to the bucket owner", "description": "The source test creates the bucket with ACL=public-read-write; here the ACL is applied to a prerequisite bucket via PutBucketAcl. Bucket-owner identity is captured from GetBucketAcl.", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4382", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read-write" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "bar" }, "identity": "alt" } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } } ] }, { "id": "acl-0019", "group": "acl", "kind": "api", "title": "Canned ACL bucket-owner-read on an alt-owned object grants READ to the bucket owner", "description": "The source test creates the bucket with ACL=public-read-write; here the ACL is applied to a prerequisite bucket via PutBucketAcl. Bucket-owner identity is captured from GetBucketAcl.", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4340", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read-write" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "bar" }, "identity": "alt" } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "bucket-owner-read" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "response": { "Grants": { "$contains": { "Permission": "READ", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } } ] }, { "id": "acl-0020", "group": "acl", "kind": "api", "title": "PutObject with canned ACL public-read grants READ to AllUsers plus owner FULL_CONTROL", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4179", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "bar", "ACL": "public-read" } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "READ", "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AllUsers", "ID": { "$absent": true }, "DisplayName": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } } ] }, { "id": "acl-0021", "group": "acl", "kind": "api", "title": "PutObject with canned ACL public-read-write grants READ and WRITE to AllUsers plus owner FULL_CONTROL", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4266", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "bar", "ACL": "public-read-write" } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" }, "expect": { "response": { "Grants": { "$length": 3, "$contains": { "Permission": "READ", "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AllUsers", "ID": { "$absent": true }, "DisplayName": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "WRITE", "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AllUsers", "ID": { "$absent": true }, "DisplayName": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } } ] }, { "id": "acl-0022", "group": "acl", "kind": "api", "title": "Default object ACL is a single FULL_CONTROL grant to the object owner", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4153", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "bar" } } ], "steps": [ { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" }, "expect": { "response": { "Grants": { "$length": 1 } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": [ { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } ] } } } } ] }, { "id": "acl-0023", "group": "acl", "kind": "api", "title": "Replacing an object ACL does not change the object's ContentType or ETag", "description": "The source test creates the bucket with ACL=public-read-write (here PutBucketAcl on a prerequisite bucket) and injects an inert x-amz-foo request header via a boto3 event hook, which is dropped here; the asserted behavior is that attributes survive PutObjectAcl.", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4473", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read-write" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "bar" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "contentType": "ContentType", "etag": "ETag" } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" }, { "Grantee": { "ID": "${res.alt.canonicalId}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "ContentType": "${cap.contentType}", "ETag": "${cap.etag}" } } } } ] }, { "id": "acl-0024", "group": "acl", "kind": "api", "title": "Grantee with FULL_CONTROL can replace the object ACL but object ownership stays with the original owner", "description": "The source test creates the bucket with ACL=public-read-write; here the ACL is applied to a prerequisite bucket via PutBucketAcl. Owner identity is captured from GetBucketAcl.", "tags": [ "tier-3", "acl", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4425", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read-write" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "bar" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${res.alt.canonicalId}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${res.alt.canonicalId}", "Type": "CanonicalUser" }, "Permission": "READ_ACP" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}" } } } } } ] }, { "id": "acl-0025", "group": "acl", "kind": "api", "title": "PutObjectAcl replacing the owner grant with READ reads back the same single grant", "tags": [ "tier-3", "acl", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4585", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "bar" } } ], "steps": [ { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "READ" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": [ { "Permission": "READ", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } ] } } } } ] }, { "id": "acl-0026", "group": "acl", "kind": "api", "title": "PutObjectAcl replacing the owner grant with READ_ACP reads back the same single grant", "tags": [ "tier-3", "acl", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4590", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "bar" } } ], "steps": [ { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "READ_ACP" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": [ { "Permission": "READ_ACP", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } ] } } } } ] }, { "id": "acl-0027", "group": "acl", "kind": "api", "title": "PutObjectAcl replacing the owner grant with WRITE reads back the same single grant", "tags": [ "tier-3", "acl", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4576", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "bar" } } ], "steps": [ { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "WRITE" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": [ { "Permission": "WRITE", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } ] } } } } ] }, { "id": "acl-0028", "group": "acl", "kind": "api", "title": "PutObjectAcl replacing the owner grant with WRITE_ACP reads back the same single grant", "tags": [ "tier-3", "acl", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4580", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "bar" } } ], "steps": [ { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "WRITE_ACP" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "response": { "Grants": [ { "Permission": "WRITE_ACP", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } ] } } } } ] }, { "id": "acl-0029", "group": "acl", "kind": "api", "title": "PutBucketAcl with an explicit AllUsers group READ grant added to the owner grant is readable back", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4118", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "AccessControlPolicy": { "Grants": [ { "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser" }, "Permission": "FULL_CONTROL" }, { "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AllUsers" }, "Permission": "READ" } ], "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$length": 2, "$contains": { "Permission": "READ", "Grantee": { "Type": "Group", "URI": "http://acs.amazonaws.com/groups/global/AllUsers", "ID": { "$absent": true }, "DisplayName": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } } ] }, { "id": "acl-0030", "group": "acl", "kind": "api", "title": "Private bucket with private object denies alt user all object reads, writes and listing", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5087", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "private" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "barcontent" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0031", "group": "acl", "kind": "api", "title": "Private bucket with public-read object lets alt user read only that object", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5142", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "public-read" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "body": "foocontent" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "foooverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0032", "group": "acl", "kind": "api", "title": "Private bucket with public-read-write object: alt user can only read that object, all writes denied", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5183", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "public-read-write" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "body": "foocontent" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "foooverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0033", "group": "acl", "kind": "api", "title": "Private bucket with private object denies alt user all object reads, writes and ListObjectsV2", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5115", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "private" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "ListObjectsV2", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "barcontent" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0034", "group": "acl", "kind": "api", "title": "Private bucket with public-read object lets alt user read only that object (ListObjectsV2 denied)", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5163", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "public-read" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "body": "foocontent" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "foooverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "ListObjectsV2", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0035", "group": "acl", "kind": "api", "title": "Private bucket with public-read-write object: alt user can only read that object (ListObjectsV2 denied)", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5204", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "public-read-write" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "body": "foocontent" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "foooverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "ListObjectsV2", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0036", "group": "acl", "kind": "api", "title": "Public-read bucket with private objects: alt user can list but not read or write objects", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5224", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "private" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "barcontent" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "response": { "Contents": [ { "Key": "bar" }, { "Key": "foo" } ] } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0037", "group": "acl", "kind": "api", "title": "Public-read bucket with public-read object: alt user can list and read the ACLed object, no writes", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5243", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "public-read" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "body": "foocontent" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "foooverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "response": { "Contents": [ { "Key": "bar" }, { "Key": "foo" } ] } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0038", "group": "acl", "kind": "api", "title": "Public-read bucket with public-read-write object: alt user can list and read the ACLed object, all writes denied", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5267", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "public-read-write" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "body": "foocontent" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "foooverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "response": { "Contents": [ { "Key": "bar" }, { "Key": "foo" } ] } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "acl-0039", "group": "acl", "kind": "api", "title": "Public-read-write bucket with private objects: alt user can list and write but not read", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5293", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read-write" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "private" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "barcontent" }, "identity": "alt" } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt" } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "response": { "Contents": [ { "Key": "bar" }, { "Key": "foo" } ] } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt" } } ] }, { "id": "acl-0040", "group": "acl", "kind": "api", "title": "Public-read-write bucket with public-read object: alt user can list, write, and read only the ACLed object", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5308", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read-write" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "public-read" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "body": "foocontent" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "barcontent" }, "identity": "alt" } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt" } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "response": { "Contents": [ { "Key": "bar" }, { "Key": "foo" } ] } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt" } } ] }, { "id": "acl-0041", "group": "acl", "kind": "api", "title": "Public-read-write bucket with public-read-write object: alt user can list, write, and read only the ACLed object", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L5326", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "foocontent" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "bar", "body": "barcontent" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read-write" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "ACL": "public-read-write" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "alt", "expect": { "body": "foocontent" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "foooverwrite" }, "identity": "alt" } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "bar", "Body": "baroverwrite" }, "identity": "alt" } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "response": { "Contents": [ { "Key": "bar" }, { "Key": "foo" } ] } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "new", "Body": "newcontent" }, "identity": "alt" } } ] }, { "id": "acl-0042", "group": "acl", "kind": "api", "title": "GetBucketOwnershipControls on a bucket created without ownership controls returns OwnershipControlsNotFoundError", "tags": [ "tier-3", "acl", "errors", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L20275", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}" }, "expect": { "status": 404, "error": "OwnershipControlsNotFoundError" } } } ] }, { "id": "acl-0043", "group": "acl", "kind": "api", "title": "PutBucketOwnershipControls BucketOwnerEnforced: rejected while bucket ACL is public-read, then enforces bucket-owner ownership and rejects non-default ACLs", "description": "The source test creates the bucket with ACL=public-read; here the ACL is applied to a prerequisite bucket via PutBucketAcl before setting ownership controls. Bucket-owner identity is captured from GetBucketAcl instead of test configuration.", "tags": [ "tier-3", "acl", "policy", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L20319", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" } } }, { "$operation": { "name": "PutBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}", "OwnershipControls": { "Rules": [ { "ObjectOwnership": "BucketOwnerEnforced" } ] } }, "expect": { "status": 400, "error": "InvalidBucketAclWithObjectOwnership" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" } } }, { "$operation": { "name": "PutBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}", "OwnershipControls": { "Rules": [ { "ObjectOwnership": "BucketOwnerEnforced" } ] } } } }, { "$operation": { "name": "GetBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "OwnershipControls": { "Rules": [ { "ObjectOwnership": "BucketOwnerEnforced" } ] } } } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"*\",\"Resource\":[\"arn:aws:s3:::${res.b1.name}\",\"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-no-acl" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-bucket-owner-full-control", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-private", "ACL": "private" }, "identity": "alt", "expect": { "status": 400, "error": "AccessControlListNotSupported" } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-no-acl" }, "identity": "alt", "capture": { "up1": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-no-acl", "UploadId": "${cap.up1}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-bucket-owner-full-control", "ACL": "bucket-owner-full-control" }, "identity": "alt", "capture": { "up2": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-bucket-owner-full-control", "UploadId": "${cap.up2}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-private", "ACL": "private" }, "identity": "alt", "expect": { "status": 400, "error": "AccessControlListNotSupported" } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-no-acl", "CopySource": "${res.b1.name}/put-object-no-acl" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-bucket-owner-full-control", "CopySource": "${res.b1.name}/put-object-no-acl", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-private", "CopySource": "${res.b1.name}/put-object-no-acl", "ACL": "private" }, "identity": "alt", "expect": { "status": 400, "error": "AccessControlListNotSupported" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" }, "identity": "alt", "expect": { "status": 400, "error": "AccessControlListNotSupported" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-no-acl", "ACL": "private" }, "identity": "alt", "expect": { "status": 400, "error": "AccessControlListNotSupported" } } } ] }, { "id": "acl-0044", "group": "acl", "kind": "api", "title": "PutBucketOwnershipControls BucketOwnerPreferred: bucket-owner-full-control ACL transfers ownership to bucket owner, other writes stay owned by writer", "description": "Bucket-owner identity is captured from GetBucketAcl; the source test's owner-inequality assertions are expressed as equality with the alt writer's canonical ID.", "tags": [ "tier-3", "acl", "policy", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L20344", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}", "OwnershipControls": { "Rules": [ { "ObjectOwnership": "BucketOwnerPreferred" } ] } } } }, { "$operation": { "name": "GetBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "OwnershipControls": { "Rules": [ { "ObjectOwnership": "BucketOwnerPreferred" } ] } } } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"*\",\"Resource\":[\"arn:aws:s3:::${res.b1.name}\",\"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-no-acl" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-bucket-owner-full-control", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-private", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-private" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-no-acl" }, "identity": "alt", "capture": { "up1": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-no-acl", "UploadId": "${cap.up1}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-bucket-owner-full-control", "ACL": "bucket-owner-full-control" }, "identity": "alt", "capture": { "up2": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-bucket-owner-full-control", "UploadId": "${cap.up2}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-private", "ACL": "private" }, "identity": "alt", "capture": { "up3": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-private", "UploadId": "${cap.up3}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-no-acl", "CopySource": "${res.b1.name}/put-object-no-acl" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-bucket-owner-full-control", "CopySource": "${res.b1.name}/put-object-no-acl", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-private", "CopySource": "${res.b1.name}/put-object-no-acl", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-private" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-no-acl", "ACL": "private" }, "identity": "alt" } } ] }, { "id": "acl-0045", "group": "acl", "kind": "api", "title": "PutBucketOwnershipControls ObjectWriter: all objects stay owned by the writing identity regardless of ACL", "description": "The source test's owner-inequality assertions (owner != bucket owner) are expressed as equality with the alt writer's canonical ID.", "tags": [ "tier-3", "acl", "policy", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L20357", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}", "OwnershipControls": { "Rules": [ { "ObjectOwnership": "ObjectWriter" } ] } } } }, { "$operation": { "name": "GetBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "OwnershipControls": { "Rules": [ { "ObjectOwnership": "ObjectWriter" } ] } } } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"*\",\"Resource\":[\"arn:aws:s3:::${res.b1.name}\",\"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-no-acl" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-bucket-owner-full-control", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-private", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-private" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-no-acl" }, "identity": "alt", "capture": { "up1": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-no-acl", "UploadId": "${cap.up1}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-bucket-owner-full-control", "ACL": "bucket-owner-full-control" }, "identity": "alt", "capture": { "up2": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-bucket-owner-full-control", "UploadId": "${cap.up2}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-private", "ACL": "private" }, "identity": "alt", "capture": { "up3": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}", "Key": "create-multipart-upload-private", "UploadId": "${cap.up3}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-no-acl", "CopySource": "${res.b1.name}/put-object-no-acl" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-bucket-owner-full-control", "CopySource": "${res.b1.name}/put-object-no-acl", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-private", "CopySource": "${res.b1.name}/put-object-no-acl", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "copy-object-private" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}" } } } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "put-object-no-acl", "ACL": "private" }, "identity": "alt" } } ] }, { "id": "acl-0046", "group": "acl", "kind": "api", "title": "CreateBucket with x-amz-grant headers grants all five permissions to the grantee", "tags": [ "tier-3", "acl", "quirk:not-aws", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4881", "prerequisites": [ { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "CreateBucket", "params": { "Bucket": "s3v-ceph-bucket-header-acl-grants", "GrantRead": "id=${res.alt.canonicalId}", "GrantWrite": "id=${res.alt.canonicalId}", "GrantReadACP": "id=${res.alt.canonicalId}", "GrantWriteACP": "id=${res.alt.canonicalId}", "GrantFullControl": "id=${res.alt.canonicalId}" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-bucket-header-acl-grants" }, "expect": { "response": { "Grants": { "$length": 5, "$contains": { "Permission": "READ", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-bucket-header-acl-grants" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "WRITE", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-bucket-header-acl-grants" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "READ_ACP", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-bucket-header-acl-grants" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "WRITE_ACP", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3v-ceph-bucket-header-acl-grants" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL", "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } } } } } } } } ] }, { "id": "acl-0047", "group": "acl", "kind": "api", "title": "BucketOwnerEnforced ownership: bucket owner owns all objects and non-default ACLs are rejected", "description": "The source compares object owners against the main account's user id from test config; here the bucket owner identity is captured from GetBucketAcl on the newly created bucket.", "tags": [ "tier-3", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L20283", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "CreateBucket", "params": { "Bucket": "${res.b1.name}-oo", "ObjectOwnership": "BucketOwnerEnforced" } } }, { "$operation": { "name": "GetBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}-oo" }, "expect": { "response": { "OwnershipControls": { "Rules": [ { "ObjectOwnership": "BucketOwnerEnforced" } ] } } } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}-oo", "Policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Principal\": {\"AWS\": \"*\"}, \"Action\": \"*\", \"Resource\": [\"arn:aws:s3:::${res.b1.name}-oo\", \"arn:aws:s3:::${res.b1.name}-oo/*\"]}]}" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}-oo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-no-acl", "Body": "" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-bucket-owner-full-control", "Body": "", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-private", "Body": "", "ACL": "private" }, "identity": "alt", "expect": { "status": 400, "error": "AccessControlListNotSupported" } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-no-acl" }, "identity": "alt", "capture": { "up1": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-no-acl", "UploadId": "${cap.up1}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-bucket-owner-full-control", "ACL": "bucket-owner-full-control" }, "identity": "alt", "capture": { "up2": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-bucket-owner-full-control", "UploadId": "${cap.up2}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-private", "ACL": "private" }, "identity": "alt", "expect": { "status": 400, "error": "AccessControlListNotSupported" } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-no-acl", "CopySource": "${res.b1.name}-oo/put-object-no-acl" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-bucket-owner-full-control", "CopySource": "${res.b1.name}-oo/put-object-no-acl", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-private", "CopySource": "${res.b1.name}-oo/put-object-no-acl", "ACL": "private" }, "identity": "alt", "expect": { "status": 400, "error": "AccessControlListNotSupported" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}-oo", "ACL": "private" }, "identity": "alt", "expect": { "status": 400, "error": "AccessControlListNotSupported" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-no-acl", "ACL": "private" }, "identity": "alt", "expect": { "status": 400, "error": "AccessControlListNotSupported" } } } ] }, { "id": "acl-0048", "group": "acl", "kind": "api", "title": "BucketOwnerPreferred ownership: bucket-owner-full-control transfers object ownership", "description": "The source asserts writer-owned objects have an owner different from the bucket owner; since the writer is the alt credential, this is expressed as equality with the alt identity. The bucket owner identity is captured from GetBucketAcl.", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L20295", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "CreateBucket", "params": { "Bucket": "${res.b1.name}-oo", "ObjectOwnership": "BucketOwnerPreferred" } } }, { "$operation": { "name": "GetBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}-oo" }, "expect": { "response": { "OwnershipControls": { "Rules": [ { "ObjectOwnership": "BucketOwnerPreferred" } ] } } } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}-oo", "Policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Principal\": {\"AWS\": \"*\"}, \"Action\": \"*\", \"Resource\": [\"arn:aws:s3:::${res.b1.name}-oo\", \"arn:aws:s3:::${res.b1.name}-oo/*\"]}]}" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}-oo" }, "capture": { "ownerId": "Owner.ID", "ownerName": "Owner.DisplayName" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-no-acl", "Body": "" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-bucket-owner-full-control", "Body": "", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-private", "Body": "", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-private" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-no-acl" }, "identity": "alt", "capture": { "up1": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-no-acl", "UploadId": "${cap.up1}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-bucket-owner-full-control", "ACL": "bucket-owner-full-control" }, "identity": "alt", "capture": { "up2": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-bucket-owner-full-control", "UploadId": "${cap.up2}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-private", "ACL": "private" }, "identity": "alt", "capture": { "up3": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-private", "UploadId": "${cap.up3}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-no-acl", "CopySource": "${res.b1.name}-oo/put-object-no-acl" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-bucket-owner-full-control", "CopySource": "${res.b1.name}-oo/put-object-no-acl", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${cap.ownerId}", "DisplayName": "${cap.ownerName}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-private", "CopySource": "${res.b1.name}-oo/put-object-no-acl", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-private" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}-oo", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-no-acl", "ACL": "private" }, "identity": "alt" } } ] }, { "id": "acl-0049", "group": "acl", "kind": "api", "title": "ObjectWriter ownership: the writer keeps object ownership regardless of ACL", "description": "The source asserts written objects have an owner different from the bucket owner; since the writer is the alt credential, this is expressed as equality with the alt identity.", "tags": [ "tier-3", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L20307", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "CreateBucket", "params": { "Bucket": "${res.b1.name}-oo", "ObjectOwnership": "ObjectWriter" } } }, { "$operation": { "name": "GetBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}-oo" }, "expect": { "response": { "OwnershipControls": { "Rules": [ { "ObjectOwnership": "ObjectWriter" } ] } } } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}-oo", "Policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Principal\": {\"AWS\": \"*\"}, \"Action\": \"*\", \"Resource\": [\"arn:aws:s3:::${res.b1.name}-oo\", \"arn:aws:s3:::${res.b1.name}-oo/*\"]}]}" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-no-acl", "Body": "" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-bucket-owner-full-control", "Body": "", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-private", "Body": "", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-private" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-no-acl" }, "identity": "alt", "capture": { "up1": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-no-acl", "UploadId": "${cap.up1}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-bucket-owner-full-control", "ACL": "bucket-owner-full-control" }, "identity": "alt", "capture": { "up2": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-bucket-owner-full-control", "UploadId": "${cap.up2}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-private", "ACL": "private" }, "identity": "alt", "capture": { "up3": "UploadId" } } }, { "$operation": { "name": "ListParts", "params": { "Bucket": "${res.b1.name}-oo", "Key": "create-multipart-upload-private", "UploadId": "${cap.up3}" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-no-acl", "CopySource": "${res.b1.name}-oo/put-object-no-acl" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-no-acl" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-bucket-owner-full-control", "CopySource": "${res.b1.name}-oo/put-object-no-acl", "ACL": "bucket-owner-full-control" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-bucket-owner-full-control" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-private", "CopySource": "${res.b1.name}-oo/put-object-no-acl", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "copy-object-private" }, "identity": "alt", "expect": { "response": { "Owner": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}" } } } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}-oo", "ACL": "private" }, "identity": "alt" } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}-oo", "Key": "put-object-no-acl", "ACL": "private" }, "identity": "alt" } } ] }, { "id": "acl-0050", "group": "acl", "kind": "api", "title": "PutObject with x-amz-grant-* headers grants each permission to a second user", "description": "The source test injects five raw x-amz-grant- headers (read, write, read-acp, write-acp, full-control) for the alt user before signing. x-amz-grant-write has NO PutObject API parameter (AWS rejects object WRITE grants, hence quirk:not-aws), so the PUT must be a raw-HTTP step rather than an operation step. GetObjectAcl must then return all five grants for that user; check_grants compares element-wise, so the ordered array asserts the order READ, WRITE, READ_ACP, WRITE_ACP, FULL_CONTROL.", "tags": [ "tier-3", "acl", "source:ceph-s3-tests", "quirk:not-aws" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L4813", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$http": { "method": "PUT", "path": "/${res.b1.name}/foo_key", "headers": { "x-amz-grant-read": "id=${res.alt.canonicalId}", "x-amz-grant-write": "id=${res.alt.canonicalId}", "x-amz-grant-read-acp": "id=${res.alt.canonicalId}", "x-amz-grant-write-acp": "id=${res.alt.canonicalId}", "x-amz-grant-full-control": "id=${res.alt.canonicalId}" }, "body": "bar" } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "foo_key" }, "expect": { "response": { "Grants": [ { "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } }, "Permission": "READ" }, { "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } }, "Permission": "WRITE" }, { "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } }, "Permission": "READ_ACP" }, { "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } }, "Permission": "WRITE_ACP" }, { "Grantee": { "ID": "${res.alt.canonicalId}", "DisplayName": "${res.alt.displayName}", "Type": "CanonicalUser", "URI": { "$absent": true }, "EmailAddress": { "$absent": true } }, "Permission": "FULL_CONTROL" } ] } } } } ] }, { "id": "acl-0051", "group": "acl", "kind": "api", "title": "PutObject combining a canned ACL with grant headers is rejected with InvalidRequest", "tags": [ "tier-1", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/acl/test_acl_edge_cases.py#L15", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "canned-vs-custom", "Body": "test", "ACL": "public-read", "GrantRead": "uri=\"http://acs.amazonaws.com/groups/global/AllUsers\"" }, "expect": { "status": 400, "error": "InvalidRequest" } } } ] }, { "id": "acl-0052", "group": "acl", "kind": "api", "title": "PutObjectAcl on a non-existent key returns NoSuchKey", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/acl/test_acl_edge_cases.py#L15", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "does-not-exist", "ACL": "public-read" }, "expect": { "status": 404, "error": "NoSuchKey" } } } ] }, { "id": "acl-0053", "group": "acl", "kind": "api", "title": "PutObjectAcl with malformed grantee id or URI is rejected with InvalidArgument", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/acl/test_acl_edge_cases.py#L15", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "invalid-grantee", "body": "test" } } ], "steps": [ { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "invalid-grantee", "GrantRead": "id=\"12345\"" }, "expect": { "status": 400, "error": "InvalidArgument" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "invalid-grantee", "GrantRead": "uri=\"http://invalid.uri.format\"" }, "expect": { "status": 400, "error": "InvalidArgument" } } } ] }, { "id": "acl-0054", "group": "acl", "kind": "api", "title": "PutObjectAcl with an empty grant list is accepted and the owner retains read access", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/acl/test_acl_edge_cases.py#L15", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "empty-grants", "body": "test" } } ], "steps": [ { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "empty-grants" }, "capture": { "ownerId": "Owner.ID" } } }, { "$operation": { "name": "PutObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "empty-grants", "AccessControlPolicy": { "Owner": { "ID": "${cap.ownerId}" }, "Grants": [] } } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "empty-grants" }, "expect": { "status": 200 } } } ] }, { "id": "acl-0055", "group": "acl", "kind": "api", "title": "Owner can read back an object written with ACL private", "tags": [ "tier-1", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_error_handling.py#L15", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "private-object", "Body": "private data", "ACL": "private" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "private-object" }, "expect": { "body": "private data" } } } ] }, { "id": "acl-0056", "group": "acl", "kind": "api", "title": "DeleteBucketOwnershipControls on a non-existing bucket returns NoSuchBucket", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_bucket_ownership_controls.py#L292", "steps": [ { "$operation": { "name": "DeleteBucketOwnershipControls", "params": { "Bucket": "no-such-bucket-msst-ownership-del" }, "expect": { "status": 404, "error": "NoSuchBucket" } } } ] }, { "id": "acl-0057", "group": "acl", "kind": "api", "title": "After DeleteBucketOwnershipControls, GetBucketOwnershipControls returns not-found", "description": "Original test accepts OwnershipControlsNotFoundError, OwnershipControlsNotFound or NoSuchOwnershipControls for the final get; all are HTTP 404, so only the status is asserted.", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_bucket_ownership_controls.py#L315", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "DeleteBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}" } } }, { "$operation": { "name": "GetBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}" }, "expect": { "status": 404 } } } ] }, { "id": "acl-0058", "group": "acl", "kind": "api", "title": "New bucket has default ObjectOwnership of BucketOwnerEnforced", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_bucket_ownership_controls.py#L204", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "OwnershipControls": { "Rules": [ { "ObjectOwnership": "BucketOwnerEnforced" } ] } } } } } ] }, { "id": "acl-0059", "group": "acl", "kind": "api", "title": "GetBucketOwnershipControls on a non-existing bucket returns NoSuchBucket", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_bucket_ownership_controls.py#L178", "steps": [ { "$operation": { "name": "GetBucketOwnershipControls", "params": { "Bucket": "no-such-bucket-msst-ownership-get" }, "expect": { "status": 404, "error": "NoSuchBucket" } } } ] }, { "id": "acl-0060", "group": "acl", "kind": "api", "title": "GetBucketOwnershipControls returns the ownership rule that was set", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_bucket_ownership_controls.py#L246", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}", "OwnershipControls": { "Rules": [ { "ObjectOwnership": "ObjectWriter" } ] } } } }, { "$operation": { "name": "GetBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "OwnershipControls": { "Rules": [ { "ObjectOwnership": "ObjectWriter" } ] } } } } } ] }, { "id": "acl-0061", "group": "acl", "kind": "api", "title": "PutBucketOwnershipControls with an invalid ObjectOwnership value is rejected", "description": "Valid values are BucketOwnerPreferred, BucketOwnerEnforced, ObjectWriter. Original test accepts MalformedXML or InvalidArgument; both are HTTP 400, so only the status is asserted.", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_bucket_ownership_controls.py#L107", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}", "OwnershipControls": { "Rules": [ { "ObjectOwnership": "invalid_ownership" } ] } }, "expect": { "status": 400 } } } ] }, { "id": "acl-0062", "group": "acl", "kind": "api", "title": "PutBucketOwnershipControls with more than one rule is rejected", "description": "Only one ownership rule is allowed. Original test accepts MalformedXML or InvalidArgument; both are HTTP 400, so only the status is asserted.", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_bucket_ownership_controls.py#L71", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}", "OwnershipControls": { "Rules": [ { "ObjectOwnership": "BucketOwnerPreferred" }, { "ObjectOwnership": "ObjectWriter" } ] } }, "expect": { "status": 400 } } } ] }, { "id": "acl-0063", "group": "acl", "kind": "api", "title": "PutBucketOwnershipControls on a non-existing bucket returns NoSuchBucket", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_bucket_ownership_controls.py#L36", "steps": [ { "$operation": { "name": "PutBucketOwnershipControls", "params": { "Bucket": "no-such-bucket-msst-ownership-put", "OwnershipControls": { "Rules": [ { "ObjectOwnership": "BucketOwnerPreferred" } ] } }, "expect": { "status": 404, "error": "NoSuchBucket" } } } ] }, { "id": "acl-0064", "group": "acl", "kind": "api", "title": "PutBucketOwnershipControls with ObjectWriter succeeds", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_bucket_ownership_controls.py#L143", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketOwnershipControls", "params": { "Bucket": "${res.b1.name}", "OwnershipControls": { "Rules": [ { "ObjectOwnership": "ObjectWriter" } ] } } } } ] }, { "id": "acl-0065", "group": "acl", "kind": "api", "title": "GetBucketAcl on a non-existing bucket returns NoSuchBucket", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L263", "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "s3vectors-nonexistent-get-acl-no-bucket-8f2a1c" }, "expect": { "status": 404, "error": "NoSuchBucket" } } } ] }, { "id": "acl-0066", "group": "acl", "kind": "api", "title": "PutBucketAcl accepts canned ACL public-read", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L186", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" } } } ] }, { "id": "acl-0067", "group": "acl", "kind": "api", "title": "PutBucketAcl accepts canned ACL public-read-write", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L186", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read-write" } } } ] }, { "id": "acl-0068", "group": "acl", "kind": "api", "title": "PutBucketAcl accepts canned ACL authenticated-read", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L186", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "authenticated-read" } } } ] }, { "id": "acl-0069", "group": "acl", "kind": "api", "title": "PutBucketAcl GrantReadACP to owner id produces a READ_ACP grant", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L601", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "GrantReadACP": "id=${cap.ownerId}" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "READ_ACP" } } } } } } ] }, { "id": "acl-0070", "group": "acl", "kind": "api", "title": "PutBucketAcl GrantWriteACP to owner id produces a WRITE_ACP grant", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L647", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "GrantWriteACP": "id=${cap.ownerId}" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "WRITE_ACP" } } } } } } ] }, { "id": "acl-0071", "group": "acl", "kind": "api", "title": "PutBucketAcl with an invalid canned ACL value returns InvalidArgument", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L319", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "invalid-acl" }, "expect": { "status": 400, "error": "InvalidArgument" } } } ] }, { "id": "acl-0072", "group": "acl", "kind": "api", "title": "PutBucketAcl with both a canned ACL and a grant header returns InvalidRequest", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L54", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private", "GrantRead": "id=testuser1" }, "expect": { "status": 400, "error": "InvalidRequest" } } } ] }, { "id": "acl-0073", "group": "acl", "kind": "api", "title": "PutBucketAcl on a non-existing bucket returns NoSuchBucket", "tags": [ "tier-3", "acl", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L28", "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "s3vectors-nonexistent-acl-no-bucket-8f2a1c", "ACL": "private" }, "expect": { "status": 404, "error": "NoSuchBucket" } } } ] }, { "id": "acl-0074", "group": "acl", "kind": "api", "title": "PutBucketAcl canned ACL private succeeds and GetBucketAcl returns Owner and Grants", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L85", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Owner": { "$exists": true }, "Grants": { "$exists": true } } } } } ] }, { "id": "acl-0075", "group": "acl", "kind": "api", "title": "PutBucketAcl canned ACL public-read succeeds and GetBucketAcl returns grants", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L131", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": {} } } } } } ] }, { "id": "acl-0076", "group": "acl", "kind": "api", "title": "Bucket ACL can be updated repeatedly across canned values", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L355", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "authenticated-read" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "private" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$exists": true } } } } } ] }, { "id": "acl-0077", "group": "acl", "kind": "api", "title": "PutBucketAcl with a full AccessControlPolicy granting owner FULL_CONTROL", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L549", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "AccessControlPolicy": { "Owner": { "ID": "${cap.ownerId}" }, "Grants": [ { "Grantee": { "Type": "CanonicalUser", "ID": "${cap.ownerId}" }, "Permission": "FULL_CONTROL" } ] } } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": {} } } } } } ] }, { "id": "acl-0078", "group": "acl", "kind": "api", "title": "PutBucketAcl GrantFullControl to owner id produces a FULL_CONTROL grant", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L501", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "GrantFullControl": "id=${cap.ownerId}" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "FULL_CONTROL" } } } } } } ] }, { "id": "acl-0079", "group": "acl", "kind": "api", "title": "PutBucketAcl GrantRead to owner id produces a READ grant", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L407", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "GrantRead": "id=${cap.ownerId}" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "READ" } } } } } } ] }, { "id": "acl-0080", "group": "acl", "kind": "api", "title": "PutBucketAcl GrantWrite to owner id produces a WRITE grant", "tags": [ "tier-3", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_acl.py#L455", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "capture": { "ownerId": "Owner.ID" } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "GrantWrite": "id=${cap.ownerId}" } } }, { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Grants": { "$contains": { "Permission": "WRITE" } } } } } } ] }, { "id": "acl-0081", "group": "acl", "kind": "api", "title": "Default bucket ACL has an owner and a FULL_CONTROL grant", "tags": [ "tier-3", "acl", "bucket", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_create_bucket_advanced.py#L207", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketAcl", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Owner": { "ID": { "$exists": true } }, "Grants": { "$contains": { "Permission": "FULL_CONTROL" } } } } } } ] } ] }