{
  "$schema": "../schema/vector.schema.json",
  "vectors": [
    {
      "id": "anon-access-0001",
      "group": "anon-access",
      "kind": "api",
      "title": "Anonymous PutObject to a private bucket returns AccessDenied",
      "tags": [
        "tier-1",
        "anon-access",
        "errors",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3572",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        },
        {
          "$object": {
            "handle": "o1",
            "bucket": "b1",
            "key": "foo",
            "body": ""
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "Body": "foo"
            },
            "identity": "anonymous",
            "expect": {
              "status": 403,
              "error": "AccessDenied"
            }
          }
        }
      ]
    },
    {
      "id": "anon-access-0002",
      "group": "anon-access",
      "kind": "api",
      "title": "Anonymous PutObject succeeds on a public-read-write bucket",
      "tags": [
        "tier-3",
        "anon-access",
        "acl",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3585",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutBucketAcl",
            "params": {
              "Bucket": "${res.b1.name}",
              "ACL": "public-read-write"
            }
          }
        },
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            }
          }
        },
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "Body": "foo"
            },
            "identity": "anonymous",
            "expect": {
              "status": 200
            }
          }
        }
      ]
    },
    {
      "id": "anon-access-0003",
      "group": "anon-access",
      "kind": "api",
      "title": "Authenticated GetObject succeeds on public-read bucket and object",
      "tags": [
        "tier-3",
        "anon-access",
        "acl",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3438",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutBucketAcl",
            "params": {
              "Bucket": "${res.b1.name}",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "GetObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            },
            "expect": {
              "status": 200
            }
          }
        }
      ]
    },
    {
      "id": "anon-access-0004",
      "group": "anon-access",
      "kind": "api",
      "title": "Owner GetObject succeeds on a public-read object despite a private bucket ACL",
      "description": "The source creates the bucket with ACL 'private', which is the default canned ACL for a new bucket, so the bucket prerequisite carries no ACL step.",
      "tags": [
        "tier-1",
        "anon-access",
        "acl",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3458",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "GetObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            },
            "expect": {
              "status": 200
            }
          }
        }
      ]
    },
    {
      "id": "anon-access-0005",
      "group": "anon-access",
      "kind": "api",
      "title": "Authenticated GetObject on a deleted bucket returns NoSuchBucket",
      "tags": [
        "tier-3",
        "anon-access",
        "acl",
        "errors",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3472",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutBucketAcl",
            "params": {
              "Bucket": "${res.b1.name}",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "DeleteObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            }
          }
        },
        {
          "$operation": {
            "name": "DeleteBucket",
            "params": {
              "Bucket": "${res.b1.name}"
            }
          }
        },
        {
          "$operation": {
            "name": "GetObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            },
            "expect": {
              "status": 404,
              "error": "NoSuchBucket"
            }
          }
        }
      ]
    },
    {
      "id": "anon-access-0006",
      "group": "anon-access",
      "kind": "api",
      "title": "Owner GetObject succeeds on a private object in a public-read bucket",
      "tags": [
        "tier-3",
        "anon-access",
        "acl",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3465",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutBucketAcl",
            "params": {
              "Bucket": "${res.b1.name}",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "ACL": "private"
            }
          }
        },
        {
          "$operation": {
            "name": "GetObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            },
            "expect": {
              "status": 200
            }
          }
        }
      ]
    },
    {
      "id": "anon-access-0007",
      "group": "anon-access",
      "kind": "api",
      "title": "Authenticated GetObject on a deleted object returns NoSuchKey",
      "tags": [
        "tier-3",
        "anon-access",
        "acl",
        "errors",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3484",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutBucketAcl",
            "params": {
              "Bucket": "${res.b1.name}",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "DeleteObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            }
          }
        },
        {
          "$operation": {
            "name": "GetObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            },
            "expect": {
              "status": 404,
              "error": "NoSuchKey"
            }
          }
        }
      ]
    },
    {
      "id": "anon-access-0008",
      "group": "anon-access",
      "kind": "api",
      "title": "Anonymous GetObject succeeds on public-read bucket and object",
      "tags": [
        "tier-3",
        "anon-access",
        "acl",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3297",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutBucketAcl",
            "params": {
              "Bucket": "${res.b1.name}",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "GetObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            },
            "identity": "anonymous",
            "expect": {
              "status": 200
            }
          }
        }
      ]
    },
    {
      "id": "anon-access-0009",
      "group": "anon-access",
      "kind": "api",
      "title": "Anonymous GetObject succeeds on a public-read object in a private bucket",
      "description": "The source creates the bucket with ACL 'private', which is the default canned ACL for a new bucket, so the bucket prerequisite carries no ACL step.",
      "tags": [
        "tier-1",
        "anon-access",
        "acl",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3385",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "GetObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            },
            "identity": "anonymous",
            "expect": {
              "status": 200
            }
          }
        }
      ]
    },
    {
      "id": "anon-access-0010",
      "group": "anon-access",
      "kind": "api",
      "title": "Anonymous GetObject on a deleted bucket returns NoSuchBucket",
      "tags": [
        "tier-3",
        "anon-access",
        "acl",
        "errors",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3304",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutBucketAcl",
            "params": {
              "Bucket": "${res.b1.name}",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "DeleteObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            }
          }
        },
        {
          "$operation": {
            "name": "DeleteBucket",
            "params": {
              "Bucket": "${res.b1.name}"
            }
          }
        },
        {
          "$operation": {
            "name": "GetObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            },
            "identity": "anonymous",
            "expect": {
              "status": 404,
              "error": "NoSuchBucket"
            }
          }
        }
      ]
    },
    {
      "id": "anon-access-0011",
      "group": "anon-access",
      "kind": "api",
      "title": "Anonymous GetObject on a private object in a public-read bucket returns AccessDenied",
      "tags": [
        "tier-3",
        "anon-access",
        "acl",
        "errors",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3392",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutBucketAcl",
            "params": {
              "Bucket": "${res.b1.name}",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "ACL": "private"
            }
          }
        },
        {
          "$operation": {
            "name": "GetObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            },
            "identity": "anonymous",
            "expect": {
              "status": 403,
              "error": "AccessDenied"
            }
          }
        }
      ]
    },
    {
      "id": "anon-access-0012",
      "group": "anon-access",
      "kind": "api",
      "title": "Anonymous GetObject on a deleted object in a public-read bucket returns NoSuchKey",
      "tags": [
        "tier-3",
        "anon-access",
        "acl",
        "errors",
        "source:ceph-s3-tests"
      ],
      "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L3332",
      "prerequisites": [
        {
          "$bucket": {
            "handle": "b1"
          }
        }
      ],
      "steps": [
        {
          "$operation": {
            "name": "PutBucketAcl",
            "params": {
              "Bucket": "${res.b1.name}",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "PutObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo",
              "ACL": "public-read"
            }
          }
        },
        {
          "$operation": {
            "name": "DeleteObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            }
          }
        },
        {
          "$operation": {
            "name": "GetObject",
            "params": {
              "Bucket": "${res.b1.name}",
              "Key": "foo"
            },
            "identity": "anonymous",
            "expect": {
              "status": 404,
              "error": "NoSuchKey"
            }
          }
        }
      ]
    }
  ]
}