{ "$schema": "../schema/vector.schema.json", "vectors": [ { "id": "policy-0001", "group": "policy", "kind": "api", "title": "GetBucketPolicyStatus reports IsPublic true after an authenticated-read canned ACL", "tags": [ "tier-3", "policy", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14099", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "authenticated-read" } } }, { "$operation": { "name": "GetBucketPolicyStatus", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PolicyStatus": { "IsPublic": true } } } } } ] }, { "id": "policy-0002", "group": "policy", "kind": "api", "title": "GetBucketPolicyStatus on a fresh private bucket reports IsPublic false", "tags": [ "tier-3", "policy", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14086", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketPolicyStatus", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PolicyStatus": { "IsPublic": false } } } } } ] }, { "id": "policy-0003", "group": "policy", "kind": "api", "title": "GetBucketPolicyStatus stays IsPublic false after attaching a policy restricted by source IP", "tags": [ "tier-3", "policy", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14135", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketPolicyStatus", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PolicyStatus": { "IsPublic": false } } } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Principal\": {\"AWS\": \"*\"}, \"Action\": \"s3:ListBucket\", \"Resource\": [\"arn:aws:s3:::${res.b1.name}\", \"arn:aws:s3:::${res.b1.name}/*\"], \"Condition\": {\"IpAddress\": {\"aws:SourceIp\": \"10.0.0.0/32\"}}}]}" } } }, { "$operation": { "name": "GetBucketPolicyStatus", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PolicyStatus": { "IsPublic": false } } } } } ] }, { "id": "policy-0004", "group": "policy", "kind": "api", "title": "GetBucketPolicyStatus reports IsPublic true after a public-read canned ACL", "tags": [ "tier-3", "policy", "acl", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14092", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" } } }, { "$operation": { "name": "GetBucketPolicyStatus", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PolicyStatus": { "IsPublic": true } } } } } ] }, { "id": "policy-0005", "group": "policy", "kind": "api", "title": "GetBucketPolicyStatus flips to IsPublic true after attaching a public bucket policy", "tags": [ "tier-3", "policy", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14107", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketPolicyStatus", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PolicyStatus": { "IsPublic": false } } } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Principal\": {\"AWS\": \"*\"}, \"Action\": \"s3:ListBucket\", \"Resource\": [\"arn:aws:s3:::${res.b1.name}\", \"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "GetBucketPolicyStatus", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PolicyStatus": { "IsPublic": true } } } } } ] }, { "id": "policy-0006", "group": "policy", "kind": "api", "title": "Put, get and delete a bucket policy; get after delete returns NoSuchBucketPolicy", "tags": [ "tier-3", "policy", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L11956", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "asdf", "body": "asdf" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Principal\": {\"AWS\": \"*\"}, \"Action\": \"s3:ListBucket\", \"Resource\": [\"arn:aws:s3:::${res.b1.name}\", \"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Principal\": {\"AWS\": \"*\"}, \"Action\": \"s3:ListBucket\", \"Resource\": [\"arn:aws:s3:::${res.b1.name}\", \"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } } }, { "$operation": { "name": "DeleteBucketPolicy", "params": { "Bucket": "${res.b1.name}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "error": "NoSuchBucketPolicy" } } } ] }, { "id": "policy-0007", "group": "policy", "kind": "api", "title": "Allow policy restricted to a specific principal reports non-public policy status", "tags": [ "tier-3", "policy", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14167", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Principal\": {\"AWS\": \"arn:aws:iam::s3tenant1:root\"}, \"Action\": \"s3:ListBucket\", \"Resource\": [\"arn:aws:s3:::${res.b1.name}\", \"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "GetBucketPolicyStatus", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PolicyStatus": { "IsPublic": false } } } } } ] }, { "id": "policy-0008", "group": "policy", "kind": "api", "title": "Deny bucket policy blocks GetPublicAccessBlock", "tags": [ "tier-3", "policy", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14236", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutPublicAccessBlock", "params": { "Bucket": "${res.b1.name}", "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": true, "BlockPublicPolicy": true, "RestrictPublicBuckets": false } } } }, { "$operation": { "name": "GetPublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": true, "BlockPublicPolicy": true, "RestrictPublicBuckets": false } } } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Action\": \"s3:GetBucketPublicAccessBlock\", \"Principal\": {\"AWS\": \"*\"}, \"Effect\": \"Deny\", \"Resource\": \"arn:aws:s3:::${res.b1.name}\"}]}" } } }, { "$operation": { "name": "GetPublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "status": 403 } } } ] }, { "id": "policy-0009", "group": "policy", "kind": "api", "title": "HeadObject under a prefix-conditioned ListBucket policy: 404 inside the prefix, 403 outside", "tags": [ "tier-3", "policy", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L20384", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Principal\": {\"AWS\": \"*\"}, \"Action\": \"s3:ListBucket\", \"Resource\": \"arn:aws:s3:::${res.b1.name}\", \"Condition\": {\"StringLike\": {\"s3:prefix\": \"public/*\"}}}]}" } } }, { "$operation": { "name": "HeadObject", "params": { "Bucket": "${res.b1.name}", "Key": "public/object" }, "identity": "alt", "expect": { "status": 404 } } }, { "$operation": { "name": "HeadObject", "params": { "Bucket": "${res.b1.name}", "Key": "private/object" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "policy-0010", "group": "policy", "kind": "api", "title": "IgnorePublicAcls makes public-read ACLs behave as private", "tags": [ "tier-3", "policy", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14415", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt" } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "key1", "Body": "abcde", "ACL": "public-read" } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "key1" }, "identity": "alt", "expect": { "body": "abcde" } } }, { "$operation": { "name": "PutPublicAccessBlock", "params": { "Bucket": "${res.b1.name}", "PublicAccessBlockConfiguration": { "BlockPublicAcls": false, "IgnorePublicAcls": true, "BlockPublicPolicy": false, "RestrictPublicBuckets": false } } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "key1" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "policy-0011", "group": "policy", "kind": "api", "title": "Delete public access block, then get returns NoSuchPublicAccessBlockConfiguration", "tags": [ "tier-3", "policy", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14441", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutPublicAccessBlock", "params": { "Bucket": "${res.b1.name}", "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": true, "BlockPublicPolicy": true, "RestrictPublicBuckets": false } } } }, { "$operation": { "name": "GetPublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": true, "BlockPublicPolicy": true, "RestrictPublicBuckets": false } } } } }, { "$operation": { "name": "DeletePublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "status": 204 } } }, { "$operation": { "name": "GetPublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "error": "NoSuchPublicAccessBlockConfiguration" } } } ] }, { "id": "policy-0012", "group": "policy", "kind": "api", "title": "PutPublicAccessBlock round-trips the configuration", "tags": [ "tier-3", "policy", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14264", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutPublicAccessBlock", "params": { "Bucket": "${res.b1.name}", "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": true, "BlockPublicPolicy": true, "RestrictPublicBuckets": false } } } }, { "$operation": { "name": "GetPublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": true, "BlockPublicPolicy": true, "RestrictPublicBuckets": false } } } } } ] }, { "id": "policy-0013", "group": "policy", "kind": "api", "title": "GetPublicAccessBlock after deleting the configuration returns NoSuchPublicAccessBlockConfiguration", "tags": [ "tier-3", "policy", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14219", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "DeletePublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "status": 204 } } }, { "$operation": { "name": "GetPublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "error": "NoSuchPublicAccessBlockConfiguration" } } } ] }, { "id": "policy-0014", "group": "policy", "kind": "api", "title": "BlockPublicAcls rejects PutObject with public canned ACLs but allows private", "tags": [ "tier-3", "policy", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14312", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutPublicAccessBlock", "params": { "Bucket": "${res.b1.name}", "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": false, "BlockPublicPolicy": false, "RestrictPublicBuckets": false } } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo1", "Body": "", "ACL": "public-read" }, "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo2", "Body": "", "ACL": "public-read-write" }, "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo3", "Body": "", "ACL": "authenticated-read" }, "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo4", "Body": "", "ACL": "private" } } } ] }, { "id": "policy-0015", "group": "policy", "kind": "api", "title": "BlockPublicPolicy rejects putting a public bucket policy", "tags": [ "tier-3", "policy", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14340", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutPublicAccessBlock", "params": { "Bucket": "${res.b1.name}", "PublicAccessBlockConfiguration": { "BlockPublicAcls": false, "IgnorePublicAcls": false, "BlockPublicPolicy": true, "RestrictPublicBuckets": false } } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" }, "expect": { "status": 403 } } } ] }, { "id": "policy-0016", "group": "policy", "kind": "api", "title": "BlockPublicAcls rejects PutBucketAcl with public and authenticated-read canned ACLs", "tags": [ "tier-3", "policy", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14283", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutPublicAccessBlock", "params": { "Bucket": "${res.b1.name}", "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": false, "BlockPublicPolicy": true, "RestrictPublicBuckets": false } } } }, { "$operation": { "name": "GetPublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true } } } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read" }, "expect": { "status": 403 } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "public-read-write" }, "expect": { "status": 403 } } }, { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "authenticated-read" }, "expect": { "status": 403 } } } ] }, { "id": "policy-0017", "group": "policy", "kind": "api", "title": "Bucket policy allowing s3:ListBucket to everyone grants list access to another account (ListObjects)", "tags": [ "tier-3", "policy", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L11510", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "asdf", "body": "asdf" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:ListBucket\",\"Resource\":[\"arn:aws:s3:::${res.b1.name}\",\"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "response": { "Contents": { "$length": 1 } } } } } ] }, { "id": "policy-0018", "group": "policy", "kind": "api", "title": "Deny s3:ListBucket bucket policy overrides authenticated-read bucket ACL (ListObjects)", "tags": [ "tier-3", "policy", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L11650", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "asdf", "body": "asdf" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "authenticated-read" } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:ListBucket\",\"Resource\":[\"arn:aws:s3:::${res.b1.name}\",\"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403, "error": "AccessDenied" } } } ] }, { "id": "policy-0019", "group": "policy", "kind": "api", "title": "Bucket policy combining Allow effect with NotPrincipal is rejected", "description": "The source accepts either InvalidArgument or MalformedPolicy as the error code (AWS returns MalformedPolicy); only the 400 status is asserted here.", "tags": [ "tier-3", "policy", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14192", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"NotPrincipal\":{\"AWS\":\"arn:aws:iam::s3tenant1:root\"},\"Action\":\"s3:ListBucket\",\"Resource\":[\"arn:aws:s3:::${res.b1.name}\",\"arn:aws:s3:::${res.b1.name}/*\"]}]}" }, "expect": { "status": 400 } } } ] }, { "id": "policy-0020", "group": "policy", "kind": "api", "title": "Wildcard-resource policy fetched via GetBucketPolicy can be applied to another bucket (ListObjects)", "tags": [ "tier-3", "policy", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L11821", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$bucket": { "handle": "b2" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "asdf", "body": "asdf" } }, { "$object": { "handle": "o2", "bucket": "b2", "key": "abcd", "body": "abcd" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:ListBucket\",\"Resource\":[\"arn:aws:s3:::*\",\"arn:aws:s3:::*/*\"]}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "capture": { "policy": "Policy" } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b2.name}", "Policy": "${cap.policy}" } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "response": { "Contents": { "$length": 1 } } } } }, { "$operation": { "name": "ListObjects", "params": { "Bucket": "${res.b2.name}" }, "identity": "alt", "expect": { "response": { "Contents": { "$length": 1 } } } } } ] }, { "id": "policy-0021", "group": "policy", "kind": "api", "title": "GetObjectAcl allowed only when s3:ExistingObjectTag condition matches; other operations stay denied", "tags": [ "tier-3", "policy", "tagging", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L13221", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "publictag", "body": "publictag" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "privatetag", "body": "privatetag" } }, { "$object": { "handle": "o3", "bucket": "b1", "key": "invalidtag", "body": "invalidtag" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:GetObjectAcl\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"StringEquals\":{\"s3:ExistingObjectTag/security\":\"public\"}}}]}" } } }, { "$operation": { "name": "PutObjectTagging", "params": { "Bucket": "${res.b1.name}", "Key": "publictag", "Tagging": { "TagSet": [ { "Key": "security", "Value": "public" }, { "Key": "foo", "Value": "bar" } ] } }, "expect": { "status": 200 } } }, { "$operation": { "name": "PutObjectTagging", "params": { "Bucket": "${res.b1.name}", "Key": "privatetag", "Tagging": { "TagSet": [ { "Key": "security", "Value": "private" } ] } }, "expect": { "status": 200 } } }, { "$operation": { "name": "PutObjectTagging", "params": { "Bucket": "${res.b1.name}", "Key": "invalidtag", "Tagging": { "TagSet": [ { "Key": "security1", "Value": "public" } ] } }, "expect": { "status": 200 } } }, { "$operation": { "name": "GetObjectAcl", "params": { "Bucket": "${res.b1.name}", "Key": "publictag" }, "identity": "alt", "expect": { "status": 200 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "publictag" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObjectTagging", "params": { "Bucket": "${res.b1.name}", "Key": "privatetag" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObjectTagging", "params": { "Bucket": "${res.b1.name}", "Key": "invalidtag" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "policy-0022", "group": "policy", "kind": "api", "title": "GetObject allowed only when s3:ExistingObjectTag condition matches the object's tag", "tags": [ "tier-3", "policy", "tagging", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L12455", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "publictag", "body": "publictag" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "privatetag", "body": "privatetag" } }, { "$object": { "handle": "o3", "bucket": "b1", "key": "invalidtag", "body": "invalidtag" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"StringEquals\":{\"s3:ExistingObjectTag/security\":\"public\"}}}]}" } } }, { "$operation": { "name": "PutObjectTagging", "params": { "Bucket": "${res.b1.name}", "Key": "publictag", "Tagging": { "TagSet": [ { "Key": "security", "Value": "public" }, { "Key": "foo", "Value": "bar" } ] } }, "expect": { "status": 200 } } }, { "$operation": { "name": "PutObjectTagging", "params": { "Bucket": "${res.b1.name}", "Key": "privatetag", "Tagging": { "TagSet": [ { "Key": "security", "Value": "private" } ] } }, "expect": { "status": 200 } } }, { "$operation": { "name": "PutObjectTagging", "params": { "Bucket": "${res.b1.name}", "Key": "invalidtag", "Tagging": { "TagSet": [ { "Key": "security1", "Value": "public" } ] } }, "expect": { "status": 200 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "publictag" }, "identity": "alt", "expect": { "status": 200 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "privatetag" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "invalidtag" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "policy-0023", "group": "policy", "kind": "api", "title": "CreateMultipartUpload requires s3:PutObject on the object ARN, not the bucket ARN", "tags": [ "tier-3", "policy", "multipart", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L11753", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "mpobj" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}\"}]}" } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "mpobj" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/mpobj\"}]}" } } }, { "$operation": { "name": "CreateMultipartUpload", "params": { "Bucket": "${res.b1.name}", "Key": "mpobj" }, "identity": "alt" } } ] }, { "id": "policy-0024", "group": "policy", "kind": "api", "title": "Deny statement on s3:x-amz-acl public* blocks PutObject with a public canned ACL but not a plain put", "tags": [ "tier-3", "policy", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L12798", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"},{\"Effect\":\"Deny\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"StringLike\":{\"s3:x-amz-acl\":\"public*\"}}}]}" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "private-key", "Body": "private-key" }, "identity": "alt", "expect": { "status": 200 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "public-key", "Body": "public-key", "ACL": "public-read" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "policy-0025", "group": "policy", "kind": "api", "title": "PutObject conditioned on s3:x-amz-copy-source restricts which sources may be copied", "tags": [ "tier-3", "policy", "copy", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L12700", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "public/foo", "body": "public/foo" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "public/bar", "body": "public/bar" } }, { "$object": { "handle": "o3", "bucket": "b1", "key": "private/foo", "body": "private/foo" } }, { "$bucket": { "handle": "b2" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b2.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b2.name}/*\",\"Condition\":{\"StringLike\":{\"s3:x-amz-copy-source\":\"${res.b1.name}/public/*\"}}}]}" } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b2.name}", "CopySource": "${res.b1.name}/public/foo", "Key": "new_foo" }, "identity": "alt" } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b2.name}", "Key": "new_foo" }, "identity": "alt", "expect": { "body": "public/foo" } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b2.name}", "CopySource": "${res.b1.name}/public/bar", "Key": "new_foo2" }, "identity": "alt" } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b2.name}", "Key": "new_foo2" }, "identity": "alt", "expect": { "body": "public/bar" } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b2.name}", "CopySource": "${res.b1.name}/private/foo", "Key": "new_foo2" }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "policy-0026", "group": "policy", "kind": "api", "title": "PutObject conditioned on s3:x-amz-metadata-directive allows COPY and denies copies without it", "tags": [ "tier-3", "policy", "copy", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L12748", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "public/foo", "body": "public/foo" } }, { "$object": { "handle": "o2", "bucket": "b1", "key": "public/bar", "body": "public/bar" } }, { "$bucket": { "handle": "b2" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b2.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b2.name}/*\",\"Condition\":{\"StringEquals\":{\"s3:x-amz-metadata-directive\":\"COPY\"}}}]}" } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b2.name}", "CopySource": "${res.b1.name}/public/foo", "Key": "new_foo", "MetadataDirective": "COPY" }, "identity": "alt" } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b2.name}", "Key": "new_foo" }, "identity": "alt", "expect": { "body": "public/foo" } } }, { "$operation": { "name": "CopyObject", "params": { "Bucket": "${res.b2.name}", "CopySource": "${res.b1.name}/public/bar", "Key": "new_foo2", "Metadata": { "foo": "bar" } }, "identity": "alt", "expect": { "status": 403 } } } ] }, { "id": "policy-0027", "group": "policy", "kind": "api", "title": "Policy requiring aws:kms denies PutObject requesting AES256 encryption", "tags": [ "tier-3", "policy", "sse", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L13149", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"StringNotEquals\":{\"s3:x-amz-server-side-encryption\":\"aws:kms\"}}},{\"Effect\":\"Deny\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"Null\":{\"s3:x-amz-server-side-encryption\":\"true\"}}}]}" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "testobj", "Body": "testobj", "ServerSideEncryption": "AES256" }, "expect": { "status": 403 } } } ] }, { "id": "policy-0028", "group": "policy", "kind": "api", "title": "PutObject allowed only when s3:RequestObjectTag condition matches the request tagging", "description": "The source test intends the second put to carry the x-amz-tagging header (its event hook is registered on the wrong client); expressed here via the Tagging parameter.", "tags": [ "tier-3", "policy", "tagging", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L13192", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"StringEquals\":{\"s3:RequestObjectTag/security\":\"public\"}}}]}" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "testobj", "Body": "testobj" }, "identity": "alt", "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "testobj", "Body": "testobj", "Tagging": "security=public" }, "identity": "alt" } } ] }, { "id": "policy-0029", "group": "policy", "kind": "api", "title": "StringNotEquals deny on s3:x-amz-server-side-encryption rejects wrong SSE algorithm and accepts AES256", "tags": [ "tier-3", "policy", "sse", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L13029", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"StringNotEquals\":{\"s3:x-amz-server-side-encryption\":\"AES256\"}}}]}" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "testobj", "Body": "testobj", "ServerSideEncryption": "AES192" }, "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "testobj", "ServerSideEncryption": "AES256" }, "expect": { "headers": { "x-amz-server-side-encryption": "AES256" } } } } ] }, { "id": "policy-0030", "group": "policy", "kind": "api", "title": "Policy requiring AES256 denies PutObject requesting aws:kms encryption", "description": "The KMS key id does not need to exist: the request is denied by the bucket policy before any KMS use.", "tags": [ "tier-3", "policy", "sse", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L13057", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"StringNotEquals\":{\"s3:x-amz-server-side-encryption\":\"AES256\"}}},{\"Effect\":\"Deny\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"Null\":{\"s3:x-amz-server-side-encryption\":\"true\"}}}]}" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "testobj", "Body": "testobj", "ServerSideEncryption": "aws:kms", "SSEKMSKeyId": "fool-me-twice" }, "expect": { "status": 403 } } } ] }, { "id": "policy-0031", "group": "policy", "kind": "api", "title": "Deny unencrypted PutObject via Null condition on s3:x-amz-server-side-encryption", "tags": [ "tier-3", "policy", "sse", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L13000", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"Null\":{\"s3:x-amz-server-side-encryption\":\"true\"}}}]}" } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "testobj", "Body": "testobj" }, "expect": { "status": 403 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "testobj", "ServerSideEncryption": "AES256" }, "expect": { "headers": { "x-amz-server-side-encryption": "AES256" } } } } ] }, { "id": "policy-0032", "group": "policy", "kind": "api", "title": "StringLikeIfExists condition on aws:Referer allows matching referers and denies non-matching ones", "tags": [ "tier-3", "policy", "wire-headers", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L11898", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "foo", "body": "" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"Allow Public Access to All Objects\",\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:GetObject\",\"Condition\":{\"StringLikeIfExists\":{\"aws:Referer\":\"http://www.example.com/*\"}},\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" } } }, { "$http": { "method": "GET", "path": "/${res.b1.name}/foo", "headers": { "referer": "http://www.example.com/" }, "expect": { "status": 200 } } }, { "$http": { "method": "GET", "path": "/${res.b1.name}/foo", "headers": { "referer": "http://www.example.com/index.html" }, "expect": { "status": 200 } } }, { "$http": { "method": "GET", "path": "/${res.b1.name}/foo", "headers": { "referer": "http://example.com" }, "expect": { "status": 403 } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" } } } ] }, { "id": "policy-0033", "group": "policy", "kind": "api", "title": "Bucket policy allowing s3:ListBucket to everyone grants list access to another account (ListObjectsV2)", "tags": [ "tier-3", "policy", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L11540", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "asdf", "body": "asdf" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:ListBucket\",\"Resource\":[\"arn:aws:s3:::${res.b1.name}\",\"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "ListObjectsV2", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "response": { "Contents": { "$length": 1 } } } } } ] }, { "id": "policy-0034", "group": "policy", "kind": "api", "title": "Deny s3:ListBucket bucket policy overrides authenticated-read bucket ACL (ListObjectsV2)", "tags": [ "tier-3", "policy", "acl", "errors", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L11686", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "asdf", "body": "asdf" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketAcl", "params": { "Bucket": "${res.b1.name}", "ACL": "authenticated-read" } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:ListBucket\",\"Resource\":[\"arn:aws:s3:::${res.b1.name}\",\"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "ListObjectsV2", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "status": 403, "error": "AccessDenied" } } } ] }, { "id": "policy-0035", "group": "policy", "kind": "api", "title": "Wildcard-resource policy fetched via GetBucketPolicy can be applied to another bucket (ListObjectsV2)", "tags": [ "tier-3", "policy", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L11859", "prerequisites": [ { "$bucket": { "handle": "b1" } }, { "$bucket": { "handle": "b2" } }, { "$object": { "handle": "o1", "bucket": "b1", "key": "asdf", "body": "asdf" } }, { "$object": { "handle": "o2", "bucket": "b2", "key": "abcd", "body": "abcd" } }, { "$credential": { "handle": "alt" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"s3:ListBucket\",\"Resource\":[\"arn:aws:s3:::*\",\"arn:aws:s3:::*/*\"]}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "capture": { "policy": "Policy" } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b2.name}", "Policy": "${cap.policy}" } } }, { "$operation": { "name": "ListObjectsV2", "params": { "Bucket": "${res.b1.name}" }, "identity": "alt", "expect": { "response": { "Contents": { "$length": 1 } } } } }, { "$operation": { "name": "ListObjectsV2", "params": { "Bucket": "${res.b2.name}" }, "identity": "alt", "expect": { "response": { "Contents": { "$length": 1 } } } } } ] }, { "id": "policy-0036", "group": "policy", "kind": "api", "title": "RestrictPublicBuckets public access block revokes anonymous access granted by a public bucket policy", "tags": [ "tier-3", "policy", "anon-access", "source:ceph-s3-tests" ], "source": "https://github.com/ceph/s3-tests/blob/5522d1c351f75bc00ae0f64f742f3f095f5939d9/s3tests/functional/test_s3.py#L14375", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "DeletePublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "status": 204 } } }, { "$operation": { "name": "PutObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo", "Body": "bar" }, "expect": { "status": 200 } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Action\": \"s3:GetObject\", \"Principal\": {\"AWS\": \"*\"}, \"Effect\": \"Allow\", \"Resource\": \"arn:aws:s3:::${res.b1.name}/*\"}]}" }, "expect": { "status": 204 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "anonymous", "expect": { "body": "bar" } } }, { "$operation": { "name": "PutPublicAccessBlock", "params": { "Bucket": "${res.b1.name}", "PublicAccessBlockConfiguration": { "BlockPublicAcls": false, "IgnorePublicAcls": false, "BlockPublicPolicy": false, "RestrictPublicBuckets": true } }, "expect": { "status": 200 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "identity": "anonymous", "expect": { "status": 403 } } }, { "$operation": { "name": "GetObject", "params": { "Bucket": "${res.b1.name}", "Key": "foo" }, "expect": { "body": "bar" } } } ] }, { "id": "policy-0037", "group": "policy", "kind": "api", "title": "Public access block configuration round-trips full, partial and all-false settings and can be deleted", "tags": [ "tier-3", "policy", "acl", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/basic/25.py#L14", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutPublicAccessBlock", "params": { "Bucket": "${res.b1.name}", "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": true, "BlockPublicPolicy": true, "RestrictPublicBuckets": true } } } }, { "$operation": { "name": "GetPublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": true, "BlockPublicPolicy": true, "RestrictPublicBuckets": true } } } } }, { "$operation": { "name": "PutPublicAccessBlock", "params": { "Bucket": "${res.b1.name}", "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": false, "BlockPublicPolicy": false, "RestrictPublicBuckets": false } } } }, { "$operation": { "name": "GetPublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "IgnorePublicAcls": false, "BlockPublicPolicy": false } } } } }, { "$operation": { "name": "PutPublicAccessBlock", "params": { "Bucket": "${res.b1.name}", "PublicAccessBlockConfiguration": { "BlockPublicAcls": false, "IgnorePublicAcls": false, "BlockPublicPolicy": false, "RestrictPublicBuckets": false } } } }, { "$operation": { "name": "GetPublicAccessBlock", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "PublicAccessBlockConfiguration": { "BlockPublicAcls": false, "IgnorePublicAcls": false, "BlockPublicPolicy": false, "RestrictPublicBuckets": false } } } } }, { "$operation": { "name": "DeletePublicAccessBlock", "params": { "Bucket": "${res.b1.name}" } } } ] }, { "id": "policy-0038", "group": "policy", "kind": "api", "title": "PutBucketPolicy accepts Action and Resource as arrays", "tags": [ "tier-3", "policy", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy_advanced.py#L151", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":[\"s3:GetObject\",\"s3:GetObjectVersion\",\"s3:ListBucket\",\"s3:ListBucketVersions\"],\"Resource\":[\"arn:aws:s3:::${res.b1.name}\",\"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Policy": { "$exists": true } } } } } ] }, { "id": "policy-0039", "group": "policy", "kind": "api", "title": "PutBucketPolicy accepts a policy with multiple Allow and Deny statements", "tags": [ "tier-3", "policy", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy_advanced.py#L31", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"AllowGetObject\",\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"},{\"Sid\":\"AllowListBucket\",\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:ListBucket\",\"Resource\":\"arn:aws:s3:::${res.b1.name}\"},{\"Sid\":\"DenyDeleteObject\",\"Effect\":\"Deny\",\"Principal\":\"*\",\"Action\":\"s3:DeleteObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Policy": { "$matches": "\"Statement\"" } } } } } ] }, { "id": "policy-0040", "group": "policy", "kind": "api", "title": "PutBucketPolicy accepts an AWS service Principal", "description": "The source test skipped when MinIO rejected the Service principal with MalformedPolicy; AWS accepts service principals such as logging.s3.amazonaws.com.", "tags": [ "tier-3", "policy", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy_advanced.py#L385", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"logging.s3.amazonaws.com\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Policy": { "$exists": true } } } } } ] }, { "id": "policy-0041", "group": "policy", "kind": "api", "title": "PutBucketPolicy accepts wildcard Resource patterns including a prefix wildcard", "tags": [ "tier-3", "policy", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy_advanced.py#L100", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":[\"s3:GetObject\",\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::${res.b1.name}/*\",\"arn:aws:s3:::${res.b1.name}/prefix/*\"]}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Policy": { "$exists": true } } } } } ] }, { "id": "policy-0042", "group": "policy", "kind": "api", "title": "PutBucketPolicy accepts the s3:* wildcard Action", "tags": [ "tier-3", "policy", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy_advanced.py#L438", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:*\",\"Resource\":[\"arn:aws:s3:::${res.b1.name}\",\"arn:aws:s3:::${res.b1.name}/*\"]}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Policy": { "$exists": true } } } } } ] }, { "id": "policy-0043", "group": "policy", "kind": "api", "title": "PutBucketPolicy replaces an existing bucket policy", "tags": [ "tier-3", "policy", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy_advanced.py#L268", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" } } }, { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":\"*\",\"Action\":\"s3:DeleteObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Policy": { "$matches": "\"Statement\"" } } } } } ] }, { "id": "policy-0044", "group": "policy", "kind": "api", "title": "DeleteBucketPolicy removes the policy; subsequent GetBucketPolicy returns NoSuchBucketPolicy", "tags": [ "tier-3", "policy", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy.py#L385", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Policy": { "$exists": true } } } } }, { "$operation": { "name": "DeleteBucketPolicy", "params": { "Bucket": "${res.b1.name}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "status": 404, "error": "NoSuchBucketPolicy" } } } ] }, { "id": "policy-0045", "group": "policy", "kind": "api", "title": "GetBucketPolicy on a bucket without a policy returns NoSuchBucketPolicy", "tags": [ "tier-3", "policy", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy.py#L359", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "status": 404, "error": "NoSuchBucketPolicy" } } } ] }, { "id": "policy-0046", "group": "policy", "kind": "api", "title": "GetBucketPolicy on a non-existent bucket returns NoSuchBucket", "description": "The source test also tolerated NoSuchBucketPolicy (MinIO); AWS returns NoSuchBucket when the bucket itself does not exist.", "tags": [ "tier-3", "policy", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy.py#L332", "steps": [ { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "s3vectors-nonexistent-policy-get-3b7d1f" }, "expect": { "status": 404, "error": "NoSuchBucket" } } } ] }, { "id": "policy-0047", "group": "policy", "kind": "api", "title": "PutBucketPolicy with syntactically invalid JSON returns MalformedPolicy", "description": "The source test also tolerated InvalidArgument and InvalidJSON; AWS returns MalformedPolicy for a policy document that is not valid JSON.", "tags": [ "tier-3", "policy", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy.py#L70", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{ invalid json }" }, "expect": { "status": 400, "error": "MalformedPolicy" } } } ] }, { "id": "policy-0048", "group": "policy", "kind": "api", "title": "PutBucketPolicy on a non-existent bucket returns NoSuchBucket", "tags": [ "tier-3", "policy", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy.py#L29", "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "s3vectors-nonexistent-policy-put-9c4e2a", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::s3vectors-nonexistent-policy-put-9c4e2a/*\"}]}" }, "expect": { "status": 404, "error": "NoSuchBucket" } } } ] }, { "id": "policy-0049", "group": "policy", "kind": "api", "title": "PutBucketPolicy with a Deny statement succeeds and is retrievable", "tags": [ "tier-3", "policy", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy.py#L273", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"DenyDeleteObject\",\"Effect\":\"Deny\",\"Principal\":\"*\",\"Action\":\"s3:DeleteObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Policy": { "$exists": true } } } } } ] }, { "id": "policy-0050", "group": "policy", "kind": "api", "title": "PutBucketPolicy accepts an IpAddress condition block and GetBucketPolicy returns it", "tags": [ "tier-3", "policy", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy_conditions.py#L82", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"IpAddress\":{\"aws:SourceIp\":[\"192.168.1.0/24\",\"10.0.0.0/8\"]}}}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Policy": { "$exists": true } } } } } ] }, { "id": "policy-0051", "group": "policy", "kind": "api", "title": "PutBucketPolicy accepts a StringLike condition block and GetBucketPolicy returns it", "tags": [ "tier-3", "policy", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/edge/test_put_bucket_policy_conditions.py#L29", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\",\"Condition\":{\"StringLike\":{\"s3:prefix\":[\"photos/*\",\"videos/*\"]}}}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "response": { "Policy": { "$exists": true } } } } } ] }, { "id": "policy-0052", "group": "policy", "kind": "api", "title": "PutBucketPolicy stores a policy that GetBucketPolicy returns", "tags": [ "tier-3", "policy", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/policies/test_bucket_policies.py#L18", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"PublicReadGetObject\",\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "status": 200, "response": { "Policy": { "$matches": "s3:GetObject" } } } } } ] }, { "id": "policy-0053", "group": "policy", "kind": "api", "title": "DeleteBucketPolicy removes the policy so GetBucketPolicy returns NoSuchBucketPolicy", "tags": [ "tier-3", "policy", "errors", "source:msst-s3" ], "source": "https://github.com/linux-kdevops/msst-s3/blob/b84a323cca5ee862e87677043f672f156c46b448/tests/policies/test_bucket_policies.py#L316", "prerequisites": [ { "$bucket": { "handle": "b1" } } ], "steps": [ { "$operation": { "name": "PutBucketPolicy", "params": { "Bucket": "${res.b1.name}", "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"PublicReadGetObject\",\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::${res.b1.name}/*\"}]}" } } }, { "$operation": { "name": "DeleteBucketPolicy", "params": { "Bucket": "${res.b1.name}" } } }, { "$operation": { "name": "GetBucketPolicy", "params": { "Bucket": "${res.b1.name}" }, "expect": { "status": 404, "error": "NoSuchBucketPolicy" } } } ] } ] }