-
Notifications
You must be signed in to change notification settings - Fork 9.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix AWS S3 bucket import of acl
and grant
attributes
#20670
Conversation
aws/resource_aws_s3_bucket.go
Outdated
// There may be more than one occurrence of each grant combination but it is apparently unimportant as | ||
// the AWS console states "The console displays combined access grants for duplicate grantees" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Example of such a case:
# aws --profile myprofile s3api get-bucket-acl --bucket mybucket
{
"Owner": {
"DisplayName": "awsroot.myaccount",
"ID": "98a033a4faed3******146099526853"
},
"Grants": [
{
"Grantee": {
"DisplayName": "awsroot.myaccount",
"ID": "98a033a4faed3******146099526853",
"Type": "CanonicalUser"
},
"Permission": "FULL_CONTROL"
},
{
"Grantee": {
"DisplayName": "awsroot.myaccount",
"ID": "98a033a4faed3******146099526853",
"Type": "CanonicalUser"
},
"Permission": "FULL_CONTROL"
}
]
}
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also found a case where there are three duplicate grants on another bucket in the same account:
# aws --profile myprofile s3api get-bucket-acl --bucket myotherbucket
{
"Owner": {
"DisplayName": "awsroot.myaccount",
"ID": "98a033a4faed389d1c9e409dab5aa9aede0b78c92084b551a946146099526853"
},
"Grants": [
{
"Grantee": {
"DisplayName": "awsroot.myaccount",
"ID": "98a033a4faed3******146099526853",
"Type": "CanonicalUser"
},
"Permission": "FULL_CONTROL"
},
{
"Grantee": {
"DisplayName": "awsroot.myaccount",
"ID": "98a033a4faed3******146099526853",
"Type": "CanonicalUser"
},
"Permission": "FULL_CONTROL"
},
{
"Grantee": {
"DisplayName": "awsroot.myaccount",
"ID": "98a033a4faed3******146099526853",
"Type": "CanonicalUser"
},
"Permission": "FULL_CONTROL"
}
]
}
More complete acceptance tests run in us-west-2:
|
aws/resource_aws_s3_bucket.go
Outdated
d.Set("acl", "aws-exec-read") | ||
case owner_full_control && !all_users_read && !all_users_write && !authenticated_users_read && !ec2_read && logdelivery_read_acp && logdelivery_write: | ||
d.Set("acl", "log-delivery-write") | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We probably want to add a default
branch that returns false
to indicate that no canned ACL matched and that we need to record all grants.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added a test case for this:
# make testacc TESTARGS='-run=TestAccAWSS3Bucket_Security_updateGrant'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSS3Bucket_Security_updateGrant -timeout 180m
=== RUN TestAccAWSS3Bucket_Security_updateGrant
=== PAUSE TestAccAWSS3Bucket_Security_updateGrant
=== CONT TestAccAWSS3Bucket_Security_updateGrant
resource_aws_s3_bucket_test.go:712: Step 5/8 error: After applying this test step and performing a `terraform refresh`, the plan was not empty.
stdout
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# aws_s3_bucket.bucket will be updated in-place
~ resource "aws_s3_bucket" "bucket" {
id = "tf-test-bucket-42309041846304674"
tags = {}
# (10 unchanged attributes hidden)
+ grant {
+ permissions = [
+ "READ",
]
+ type = "Group"
+ uri = "http://acs.amazonaws.com/groups/global/AllUsers"
}
+ grant {
+ permissions = [
+ "READ_ACP",
]
+ type = "Group"
+ uri = "http://acs.amazonaws.com/groups/s3/LogDelivery"
}
+ grant {
+ id = "d6d601a******992e82e04d96d"
+ permissions = [
+ "FULL_CONTROL",
]
+ type = "CanonicalUser"
}
# (1 unchanged block hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.
--- FAIL: TestAccAWSS3Bucket_Security_updateGrant (170.02s)
FAIL
FAIL github.com/terraform-providers/terraform-provider-aws/aws 170.104s
FAIL
make: *** [GNUmakefile:30: testacc] Error 1
And implemented the above mentioned fix to make the test pass:
# make testacc TESTARGS='-run=TestAccAWSS3Bucket_Security_updateGrant'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSS3Bucket_Security_updateGrant -timeout 180m
=== RUN TestAccAWSS3Bucket_Security_updateGrant
=== PAUSE TestAccAWSS3Bucket_Security_updateGrant
=== CONT TestAccAWSS3Bucket_Security_updateGrant
--- PASS: TestAccAWSS3Bucket_Security_updateGrant (242.17s)
PASS
ok github.com/terraform-providers/terraform-provider-aws/aws 242.255s
d0d121f
to
0c3449d
Compare
0c3449d
to
360c9af
Compare
Pull request #21306 has significantly refactored the AWS Provider codebase. As a result, most PRs opened prior to the refactor now have merge conflicts that must be resolved before proceeding. Specifically, PR #21306 relocated the code for all AWS resources and data sources from a single We recognize that many pull requests have been open for some time without yet being addressed by our maintainers. Therefore, we want to make it clear that resolving these conflicts in no way affects the prioritization of a particular pull request. Once a pull request has been prioritized for review, the necessary changes will be made by a maintainer -- either directly or in collaboration with the pull request author. For a more complete description of this refactor, including examples of how old filepaths and function names correspond to their new counterparts: please refer to issue #20000. For a quick guide on how to amend your pull request to resolve the merge conflicts resulting from this refactor and bring it in line with our new code patterns: please refer to our Service Package Refactor Pull Request Guide. |
Rebased on current main branch, acceptance tests results:
|
360c9af
to
cc88c0f
Compare
cc88c0f
to
f2fdc22
Compare
f2fdc22
to
b5a12e2
Compare
b5a12e2
to
b290c70
Compare
… whole grants combination does not match a canned ACL
b290c70
to
4748e32
Compare
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
Community Note
Closes #6193 and #17791
Relates #3728
Output from acceptance testing: