Avoid overwriting existing resources in s3-access policy statements (#…

…768) Should have stuck to my original code - updating Statement dicts with empty Resource list removes all resources 🤦‍♂️
ministryofjustice · Oct 22, 2019 · a0e4bde · a0e4bde
1 parent 54371e9
commit a0e4bde
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 3 deletions.
diff --git a/controlpanel/api/aws.py b/controlpanel/api/aws.py
@@ -106,19 +106,16 @@ def iam_arn(resource, account=settings.AWS_ACCOUNT_ID):
             's3:ListBucket',
         ],
         'Effect': 'Allow',
-        'Resource': [],
     },
     'readonly': {
         'Sid': 'readonly',
         'Action': READ_ACTIONS,
         'Effect': 'Allow',
-        'Resource': [],
     },
     'readwrite': {
         'Sid': 'readwrite',
         'Action': READ_ACTIONS + WRITE_ACTIONS,
         'Effect': 'Allow',
-        'Resource': [],
     },
 }
 

diff --git a/tests/api/test_aws.py b/tests/api/test_aws.py
@@ -308,6 +308,14 @@ def test_grant_bucket_access(iam, users, resources):
     else:
         assert bucket_arn in statements['list']['Resource']
 
+    aws.grant_bucket_access(user.iam_role_name, f'{bucket_arn}-2', 'readonly')
+    policy.reload()
+    statements = get_statements_by_sid(policy.policy_document)
+    expected_num_resources = 2
+    if path_arns:
+        expected_num_resources = len(path_arns) + 1
+    assert len(statements['readonly']['Resource']) == expected_num_resources
+
 
 @pytest.mark.parametrize(
     'resources',