Resource based s3:GetObject ACL for container instances

degica · Sep 29, 2017 · b12f46b · b12f46b
1 parent cab56ba
commit b12f46b
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 4 deletions.
diff --git a/lib/barcelona/network/vpc_builder.rb b/lib/barcelona/network/vpc_builder.rb
@@ -323,10 +323,17 @@ def build_resources
                       "logs:CreateLogStream",
                       "logs:DescribeLogStreams",
                       "logs:PutLogEvents",
-                      "s3:Get*",
-                      "s3:List*"
                     ],
                     "Resource" => ["*"]
+                  },
+                  {
+                    "Effect" => "Allow",
+                    "Action" => [
+                      "s3:GetObject"
+                    ],
+                    "Resource" => [
+                      "arn:aws:s3:::#{stack.district.s3_bucket_name}/#{stack.district.name}/*"
+                    ]
                   }
                 ]
               }

diff --git a/spec/lib/barcelona/network/network_stack_spec.rb b/spec/lib/barcelona/network/network_stack_spec.rb
@@ -485,10 +485,17 @@
                       "logs:CreateLogStream",
                       "logs:DescribeLogStreams",
                       "logs:PutLogEvents",
-                      "s3:Get*",
-                      "s3:List*"
                     ],
                     "Resource"=>["*"]
+                  },
+                  {
+                    "Effect" => "Allow",
+                    "Action" => [
+                      "s3:GetObject"
+                    ],
+                    "Resource" => [
+                      "arn:aws:s3:::#{district.s3_bucket_name}/#{district.name}/*"
+                    ]
                   }
                 ]
               }