fix(s3): grantRead does not allow s3:HeadObject

[lpizzinidev]

Fixes the policy enforced by grantRead to allow operations that require to read an object's metadata, for example:

s3 = boto3.client("s3")
# this operation requires s3:HeadObject permission
s3.download_file(bucket, key, filepath)

Closes #27389.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

[lpizzinidev]

Exemption Request.
The bucket.grantRead function already has extensive coverage in both unit and functional tests.

[tmokmss]

Thank you!

[vinayak-kukreja]

Thank you for your contribution. And, thank you @tmokmss for reviewing the PR. :)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Pull request has been modified.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: c2e7a2e
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[sixcorners]

Is HeadObject a real action? I think the iam console seems to see s3:HeadObject as an unrecognized action.. Unless I messed something up.

[lpizzinidev]

@sixcorners
It seems you're right.

@tmokmss Thoughts?

[tmokmss]

@lpizzinidev @sixcorners Hmm, I confirmed that you are right. There's no action named s3:HeadObject (source) and HeadObject API succeeds if GetObject is allowed. So I misunderstood that the 403 error I was getting with the HeadObject was due to lack of IAM permission, but in fact it was because the object with the specified key did not exist and listBucket action was not allowed (source). Sorry for me jumping to a wrong conclusion 🙏 (I believe it's at least not a huge problem because deployment succeeds anyway, isn't it?)

I think we should revert this change. Maybe we can discuss if we should allow listBucket as well, but that's a completely different issue...

[lpizzinidev]

@tmokmss Agree.
@vinayak-kukreja This PR should be reverted as it is adding an unrecognized action to the policy.
@sixcorners Thanks for the feedback! 💪

[zxkane]

The unrecoginized s3:HeadObject will break the cfn-lint scan.