Skip to content

Commit

Permalink
feat: Add S3 bucket owner enforcement (#694)
Browse files Browse the repository at this point in the history
feat: Add S3 bucket owner enforcement

SUMMARY

AWS finally supports the ability to enforce object ownership such that the owner of the bucket owns all objects. This adds support for that.

ISSUE TYPE


Feature Pull Request

COMPONENT NAME

s3_bucket
ADDITIONAL INFORMATION



---
  - hosts: localhost
    tasks:
      - s3_bucket:
          name: tyler-test-123
          state: present

      - s3_bucket:
          name: tyler-test-123
          object_ownership: BucketOwnerEnforced
          state: present

      - s3_bucket:
          name: tyler-test-123
          state: absent

      - s3_bucket:
          name: tyler-test-123
          object_ownership: BucketOwnerEnforced
          state: present

      - s3_bucket:
          name: tyler-test-123
          state: absent

Reviewed-by: Alina Buzachis <None>
Reviewed-by: Markus Bergholz <[email protected]>
  • Loading branch information
Tyler Schwend authored Mar 24, 2022
1 parent 6d0e294 commit 7cf0e50
Show file tree
Hide file tree
Showing 3 changed files with 37 additions and 4 deletions.
2 changes: 2 additions & 0 deletions changelogs/fragments/694-s3_bucket-owner_enforcement.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
minor_changes:
- s3_bucket - Add support for enforced bucket owner object ownership (https://github.com/ansible-collections/amazon.aws/pull/694).
9 changes: 7 additions & 2 deletions plugins/modules/s3_bucket.py
Original file line number Diff line number Diff line change
Expand Up @@ -124,12 +124,17 @@
object_ownership:
description:
- Allow bucket's ownership controls.
- C(BucketOwnerEnforced) - ACLs are disabled and no longer affect access permissions to your
bucket. Requests to set or update ACLs fail. However, requests to read ACLs are supported.
Bucket owner has full ownership and control. Object writer no longer has full ownership and
control.
- C(BucketOwnerPreferred) - Objects uploaded to the bucket change ownership to the bucket owner
if the objects are uploaded with the bucket-owner-full-control canned ACL.
- C(ObjectWriter) - The uploading account will own the object
if the object is uploaded with the bucket-owner-full-control canned ACL.
- This option cannot be used together with a I(delete_object_ownership) definition.
choices: [ 'BucketOwnerPreferred', 'ObjectWriter' ]
- C(BucketOwnerEnforced) has been added in version 3.2.0.
choices: [ 'BucketOwnerEnforced', 'BucketOwnerPreferred', 'ObjectWriter' ]
type: str
version_added: 2.0.0
delete_object_ownership:
Expand Down Expand Up @@ -1016,7 +1021,7 @@ def main():
block_public_policy=dict(type='bool', default=False),
restrict_public_buckets=dict(type='bool', default=False))),
delete_public_access=dict(type='bool', default=False),
object_ownership=dict(type='str', choices=['BucketOwnerPreferred', 'ObjectWriter']),
object_ownership=dict(type='str', choices=['BucketOwnerEnforced', 'BucketOwnerPreferred', 'ObjectWriter']),
delete_object_ownership=dict(type='bool', default=False),
acl=dict(type='str', choices=['private', 'public-read', 'public-read-write', 'authenticated-read']),
validate_bucket_name=dict(type='bool', default=True),
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@
- output.object_ownership
- output.object_ownership == 'ObjectWriter'

- name: 'update s3 bucket ownership controls'
- name: 'update s3 bucket ownership preferred controls'
s3_bucket:
name: '{{ local_bucket_name }}'
state: present
Expand All @@ -64,7 +64,7 @@
- output.object_ownership
- output.object_ownership == 'BucketOwnerPreferred'

- name: 'test idempotency update s3 bucket ownership controls'
- name: 'test idempotency update s3 bucket ownership preferred controls'
s3_bucket:
name: '{{ local_bucket_name }}'
state: present
Expand All @@ -77,6 +77,32 @@
- output.object_ownership
- output.object_ownership == 'BucketOwnerPreferred'

- name: 'update s3 bucket ownership enforced controls'
s3_bucket:
name: '{{ local_bucket_name }}'
state: present
object_ownership: BucketOwnerEnforced
register: output

- assert:
that:
- output.changed
- output.object_ownership
- output.object_ownership == 'BucketOwnerEnforced'

- name: 'test idempotency update s3 bucket ownership preferred controls'
s3_bucket:
name: '{{ local_bucket_name }}'
state: present
object_ownership: BucketOwnerEnforced
register: output

- assert:
that:
- output.changed is false
- output.object_ownership
- output.object_ownership == 'BucketOwnerEnforced'

- name: 'delete s3 bucket ownership controls'
s3_bucket:
name: '{{ local_bucket_name }}'
Expand Down

0 comments on commit 7cf0e50

Please sign in to comment.