Git Product home page Git Product logo

Comments (4)

simonw avatar simonw commented on August 19, 2024

My best guess is that AWS changed something and now this code here:

bucket_policy = {}
if public:
bucket_policy = policies.bucket_policy_allow_all_get(bucket)

if bucket_policy:
s3.put_bucket_policy(
Bucket=bucket, Policy=json.dumps(bucket_policy)
)
log("Attached bucket policy allowing public access")

Is failing because I should have run this first:

s3.put_public_access_block(
    Bucket=bucket,
    PublicAccessBlockConfiguration={
        "BlockPublicAcls": False,
        "IgnorePublicAcls": False,
        "BlockPublicPolicy": False,
        "RestrictPublicBuckets": False,
    },
)

from s3-credentials.

simonw avatar simonw commented on August 19, 2024

Here's what a --dry-run looks like now:

s3-credentials create simonw-test-public-access2 --create-bucket --public --dry-run
Would create bucket: 'simonw-test-public-access2'
... then this public access block configuration:
{"BlockPublicAcls": false, "IgnorePublicAcls": false, "BlockPublicPolicy": false, "RestrictPublicBuckets": false}
... then attach the following bucket policy to it:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAllGetObject",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::simonw-test-public-access2/*"
            ]
        }
    ]
}
Would create user: 's3.read-write.simonw-test-public-access2' with permissions boundary: 'arn:aws:iam::aws:policy/AmazonS3FullAccess'
Would attach policy called 's3.read-write.simonw-test-public-access2' to user 's3.read-write.simonw-test-public-access2', details:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::simonw-test-public-access2"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectLegalHold",
                "s3:GetObjectRetention",
                "s3:GetObjectTagging"
            ],
            "Resource": [
                "arn:aws:s3:::simonw-test-public-access2/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::simonw-test-public-access2/*"
            ]
        }
    ]
}
Would call create access key for user 's3.read-write.simonw-test-public-access2'

from s3-credentials.

simonw avatar simonw commented on August 19, 2024

And debug-bucket against a bucket created with those options:

s3-credentials debug-bucket simonw-test-public-access2
Bucket ACL:
{
    "Owner": {
        "DisplayName": "swillison",
        "ID": "36b2eeee501c5952a8ac119f9e5212277a4c01eccfa8d6a9d670bba1e2d5f441"
    },
    "Grants": [
        {
            "Grantee": {
                "DisplayName": "swillison",
                "ID": "36b2eeee501c5952a8ac119f9e5212277a4c01eccfa8d6a9d670bba1e2d5f441",
                "Type": "CanonicalUser"
            },
            "Permission": "FULL_CONTROL"
        }
    ]
}
Bucket policy status:
{
    "PolicyStatus": {
        "IsPublic": true
    }
}
Bucket public access block:
{
    "PublicAccessBlockConfiguration": {
        "BlockPublicAcls": false,
        "IgnorePublicAcls": false,
        "BlockPublicPolicy": false,
        "RestrictPublicBuckets": false
    }
}

from s3-credentials.

simonw avatar simonw commented on August 19, 2024

And uploading a file to it:

s3-credentials put-object \
  simonw-test-public-access2 chicken.png \
  ~/Desktop/Archive/black_and_white_spotted_chicken,_realistic_photo,_garden.png

Resulted in:

https://s3.amazonaws.com/simonw-test-public-access2/chicken.png

So this worked.

from s3-credentials.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.