Skip to content

chore(s3): updated documentation to provide better insights when using grant methods for the Bucket resource #34733

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 4 commits into from
Jun 17, 2025
Merged

chore(s3): updated documentation to provide better insights when using grant methods for the Bucket resource #34733

merged 4 commits into from
Jun 17, 2025

Conversation

alvazjor
Copy link
Contributor

Issue # (if applicable)

Closes #34545 .

Reason for this change

Current behavior in some grant methods for the Bucket resource might cause confusion and be seen as a bug.

Description of changes

Added more details on the policy specifics, explaining why the current behavior is like that, and added additional resources if the implementer needs to restrict even more their permissions.

Describe any new or updated permissions being added

N/A

Description of how you validated changes

N/A. Just documentation being updated.

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@alvazjor alvazjor linked an issue Jun 16, 2025 that may be closed by this pull request
X-account S3 grantRead() does not respect objectKeysPattern #34545
Closed
1 task
@github-actions github-actions bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p1 labels Jun 16, 2025
@aws-cdk-automation aws-cdk-automation requested a review from a team June 16, 2025 16:44
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label Jun 16, 2025
@alvazjor alvazjor added the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label Jun 16, 2025
@aws-cdk-automation aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jun 16, 2025
@kumsmrit kumsmrit self-assigned this Jun 17, 2025
kumsmrit
kumsmrit reviewed Jun 17, 2025
View reviewed changes
packages/aws-cdk-lib/aws-s3/README.md Outdated

The S3 construct library provides three grant methods for the `Bucket` resource that have a special behavior. All three accept an `objectsKeyPattern` parameter to restrict granted permissions to specific resources:
- `grantRead`
- `grantWrite`
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think grantWrite is not applicable here, since the associated actions (DeleteObject*, PutObject*) are applicable at the object level: https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-bucket.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed it

@aws-cdk-automation aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jun 17, 2025
@mergify Mergify
Copy link
Contributor

mergify bot commented Jun 17, 2025

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: ca2d31b
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify Mergify
Copy link
Contributor

mergify bot commented Jun 17, 2025

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify bot merged commit e7c3b53 into main Jun 17, 2025
17 checks passed
@mergify mergify bot deleted the issue-34545 branch June 17, 2025 11:13
@github-actions GitHub Actions
Copy link
Contributor

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jun 17, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@kumsmrit kumsmrit kumsmrit approved these changes

Assignees

@kumsmrit kumsmrit

Labels
bug This issue is a bug. contribution/core This is a PR that came from AWS. effort/medium Medium work item – several days of effort p1 pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

X-account S3 grantRead() does not respect objectKeysPattern
3 participants
@alvazjor @aws-cdk-automation @kumsmrit