fix(s3): grantRead does not allow s3:HeadObject

aws · Oct 6, 2023 · 5026000 · 5026000
1 parent c68ea44
commit 5026000
Show file tree

Hide file tree

Showing 124 changed files with 299 additions and 14 deletions.
diff --git a/...ebuild/test/integ.asset-build-spec.js.snapshot/CodeBuildAssetBuildSpecStack.template.json b/...ebuild/test/integ.asset-build-spec.js.snapshot/CodeBuildAssetBuildSpecStack.template.json
@@ -26,6 +26,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...k-integ/test/aws-codebuild/test/integ.caching.js.snapshot/aws-cdk-codebuild.template.json b/...k-integ/test/aws-codebuild/test/integ.caching.js.snapshot/aws-cdk-codebuild.template.json
@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/.../test/aws-codebuild/test/integ.project-bucket.js.snapshot/aws-cdk-codebuild.template.json b/.../test/aws-codebuild/test/integ.project-bucket.js.snapshot/aws-cdk-codebuild.template.json
@@ -31,6 +31,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...t-buildspec-artifacts.js.snapshot/aws-cdk-codebuild-buildspec-artifact-name.template.json b/...t-buildspec-artifacts.js.snapshot/aws-cdk-codebuild-buildspec-artifact-name.template.json
@@ -33,6 +33,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...sources-artifacts.js.snapshot/aws-cdk-codebuild-secondary-sources-artifacts.template.json b/...sources-artifacts.js.snapshot/aws-cdk-codebuild-secondary-sources-artifacts.template.json
@@ -31,6 +31,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -63,6 +64,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...test/server/integ.deployment-group.js.snapshot/aws-cdk-codedeploy-server-dg.template.json b/...test/server/integ.deployment-group.js.snapshot/aws-cdk-codedeploy-server-dg.template.json
@@ -445,6 +445,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...tions/test/cloudformation/integ.stacksets.js.snapshot/StackSetPipelineStack.template.json b/...tions/test/cloudformation/integ.stacksets.js.snapshot/StackSetPipelineStack.template.json
@@ -170,6 +170,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -392,6 +393,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -556,6 +558,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/....cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json b/....cfn-template-from-repo.lit.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json
@@ -158,6 +158,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -433,6 +434,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -558,6 +560,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -668,6 +671,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...st/integ.lambda-deployed-through-codepipeline.lit.js.snapshot/PipelineStack.template.json b/...st/integ.lambda-deployed-through-codepipeline.lit.js.snapshot/PipelineStack.template.json
@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -497,6 +498,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -614,6 +616,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -923,6 +926,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -1031,6 +1035,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -1347,6 +1352,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -1558,6 +1564,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...-actions/test/integ.lambda-pipeline.js.snapshot/aws-cdk-codepipeline-lambda.template.json b/...-actions/test/integ.lambda-pipeline.js.snapshot/aws-cdk-codepipeline-lambda.template.json
@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -360,6 +361,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...t/integ.pipeline-alexa-deploy.js.snapshot/aws-cdk-codepipeline-alexa-deploy.template.json b/...t/integ.pipeline-alexa-deploy.js.snapshot/aws-cdk-codepipeline-alexa-deploy.template.json
@@ -162,6 +162,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -361,6 +362,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...n-cross-region.js.snapshot/aws-cdk-codepipeline-cloudformation-cross-region.template.json b/...n-cross-region.js.snapshot/aws-cdk-codepipeline-cloudformation-cross-region.template.json
@@ -38,6 +38,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -233,6 +234,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -351,6 +353,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -438,6 +441,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/....snapshot/aws-cdk-codepipeline-cloudformation-cross-region-with-action-role.template.json b/....snapshot/aws-cdk-codepipeline-cloudformation-cross-region-with-action-role.template.json
@@ -66,6 +66,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -163,6 +164,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -356,6 +358,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -453,6 +456,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...ons/test/integ.pipeline-cfn.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json b/...ons/test/integ.pipeline-cfn.js.snapshot/aws-cdk-codepipeline-cloudformation.template.json
@@ -152,6 +152,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -408,6 +409,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -535,6 +537,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -672,6 +675,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/....pipeline-code-build-batch.js.snapshot/aws-cdk-codepipeline-codebuild-batch.template.json b/....pipeline-code-build-batch.js.snapshot/aws-cdk-codepipeline-codebuild-batch.template.json
@@ -109,6 +109,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -425,6 +426,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",

diff --git a/...-outputs.js.snapshot/aws-cdk-codepipeline-codebuild-multiple-inputs-outputs.template.json b/...-outputs.js.snapshot/aws-cdk-codepipeline-codebuild-multiple-inputs-outputs.template.json
@@ -109,6 +109,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -170,6 +171,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -530,6 +532,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...ine-code-commit-build.js.snapshot/aws-cdk-codepipeline-codecommit-codebuild.template.json b/...ine-code-commit-build.js.snapshot/aws-cdk-codepipeline-codecommit-codebuild.template.json
@@ -91,6 +91,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -358,6 +359,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -614,6 +616,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...test/integ.pipeline-code-commit.js.snapshot/aws-cdk-codepipeline-codecommit.template.json b/...test/integ.pipeline-code-commit.js.snapshot/aws-cdk-codepipeline-codecommit.template.json
@@ -223,6 +223,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -431,6 +432,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",

diff --git a/...eg.pipeline-code-deploy-ecs.js.snapshot/aws-cdk-codepipeline-codedeploy-ecs.template.json b/...eg.pipeline-code-deploy-ecs.js.snapshot/aws-cdk-codepipeline-codedeploy-ecs.template.json
@@ -38,6 +38,7 @@
         "s3:DeleteObject*",
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*",
         "s3:PutObject",
         "s3:PutObjectLegalHold",
@@ -230,6 +231,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",
@@ -438,6 +440,7 @@
        "Action": [
         "s3:GetBucket*",
         "s3:GetObject*",
+        "s3:HeadObject",
         "s3:List*"
        ],
        "Effect": "Allow",