DEV-16804 - fixes a bug where ListBucket is not set at root when specifying paths

CHANGELOG.md

@@ -1,5 +1,8 @@
 # Tamr S3 Module Repo
 
+## v1.3.3 - August 9th 2022
+* Adds list bucket permission to the root of the bucket when specifying specific read or write paths
+
 ## v1.3.2 - August 9th 2022
 * Fixes a bug where two resources were controlling server side encryption
 

VERSION

@@ -1 +1 @@
-1.3.2
+1.3.3

modules/bucket-iam-policy/main.tf

@@ -45,6 +45,16 @@ data "aws_iam_policy_document" "path_specific_ro_doc" {
       ]
     }
   }
+  // ListBucket must be applied at the root of the bucket
+  statement {
+    sid     = "ListBucketPolicy0"
+    effect  = "Allow"
+    actions = ["s3:ListBucket"]
+    resources = [
+      "arn:${var.arn_partition}:s3:::${var.bucket_name}",
+      "arn:${var.arn_partition}:s3:::${var.bucket_name}/*"
+    ]
+  }
 }
 
 # Appended to policy name to allow creation of multiple policies on the same bucket.
@@ -70,7 +80,7 @@ data "aws_iam_policy_document" "rw_source_policy_doc" {
   version = "2012-10-17"
 
   statement {
-    sid     = "ReadWritePolicy0"
+    sid     = "ReadWritePolicyRO"
     effect  = "Allow"
     actions = var.read_write_actions
     resources = [
@@ -102,6 +112,16 @@ data "aws_iam_policy_document" "path_specific_rw_doc" {
       ]
     }
   }
+  // ListBucket must be applied at the root of the bucket
+  statement {
+    sid     = "ListBucketPolicyRW"
+    effect  = "Allow"
+    actions = ["s3:ListBucket"]
+    resources = [
+      "arn:${var.arn_partition}:s3:::${var.bucket_name}",
+      "arn:${var.arn_partition}:s3:::${var.bucket_name}/*"
+    ]
+  }
 }
 
 # Read-write IAM policy

test/s3_test.go

@@ -29,12 +29,12 @@ func initTestCases() []BucketTestCase {
 			region:           "",
 			tfDir:            "test_examples/minimal",
 			bucket_name:      "",
-			testName:         "TestBucketSinglePath",
+			testName:         "TestBucketSingleReadPath",
 			expectApplyError: false,
 			vars: map[string]interface{}{
 				"test_bucket_name": "",
 				"read_only_paths":  []string{"path/to/ro-folder"},
-				"read_write_paths": []string{"path/to/rw-folder"},
+				"read_write_paths": []string{},
 			},
 			objTestCases: []ObjectTestCase{
 				{
@@ -43,12 +43,6 @@ func initTestCases() []BucketTestCase {
 					expectPassRead:  true,
 					expectPassWrite: false,
 				},
-				{
-					key:             "path/to/rw-folder/obj2",
-					encryption:      "AES256",
-					expectPassRead:  true,
-					expectPassWrite: true,
-				},
 				{
 					key:             "other/folder/obj3",
 					encryption:      "AES256",
@@ -57,6 +51,38 @@ func initTestCases() []BucketTestCase {
 				},
 			},
 		},
+		{
+        			region:           "",
+        			tfDir:            "test_examples/minimal",
+        			bucket_name:      "",
+        			testName:         "TestBucketSingleWritePath",
+        			expectApplyError: false,
+        			vars: map[string]interface{}{
+        				"test_bucket_name": "",
+        				"read_only_paths":  []string{},
+        				"read_write_paths": []string{"path/to/rw-folder"},
+        			},
+        			objTestCases: []ObjectTestCase{
+        				{
+        					key:             "path/to/ro-folder/obj1",
+        					encryption:      "AES256",
+        					expectPassRead:  true,
+        					expectPassWrite: false,
+        				},
+        				{
+        					key:             "path/to/rw-folder/obj2",
+        					encryption:      "AES256",
+        					expectPassRead:  true,
+        					expectPassWrite: true,
+        				},
+        				{
+        					key:             "other/folder/obj3",
+        					encryption:      "AES256",
+        					expectPassRead:  true,
+        					expectPassWrite: false,
+        				},
+        			},
+        		},
 		{
 			region:           "",
 			tfDir:            "test_examples/minimal",
@@ -72,7 +98,7 @@ func initTestCases() []BucketTestCase {
 				{
 					key:             "random/path/obj1",
 					encryption:      "AES256",
-					expectPassRead:  false,
+					expectPassRead:  true,
 					expectPassWrite: false,
 				},
 				{
@@ -103,7 +129,7 @@ func initTestCases() []BucketTestCase {
 					// not setting encryption here to make sure we cannot upload unencrypted objects
 					encryption:      "",
 					key:             "path1/to/rw-folder/obj2",
-					expectPassRead:  false,
+					expectPassRead:  true,
 					expectPassWrite: false,
 				},
 			},