fix(s3): bucket deletion fails if object creation races against clean…

…up (#26875) Adds a DENY policy for S3:PutObject on buckets to be auto-deleted to prevent a race condition on emptying with external bucket writers. As a new contributor, the requirements for integration testing were unclear to me. I have tested the policy on my own buckets and included unit tests, but am willing to work toward code compliance with assistance. Closes #26874. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
aws · Sep 28, 2023 · 735b786 · 735b786
1 parent 0c66a20
commit 735b786
Show file tree

Hide file tree

Showing 303 changed files with 143,925 additions and 5,187 deletions.
diff --git a/....snapshot/asset.2ec8ad9e91dcd6e7ad6a5c84ffc6c9c05c408aca3b26ceb2816d81043e6c4dc3/index.js b/....snapshot/asset.2ec8ad9e91dcd6e7ad6a5c84ffc6c9c05c408aca3b26ceb2816d81043e6c4dc3/index.js
diff --git a/....snapshot/asset.3e6ea85c994cf2198f02e67a9e98e8f23456efa8bd72dd55b3a86454c4db9d5f/index.js b/....snapshot/asset.3e6ea85c994cf2198f02e67a9e98e8f23456efa8bd72dd55b3a86454c4db9d5f/index.js
diff --git a/...l/test/integ.cloudtrail-insight.js.snapshot/aws-cdk-cloudtrail-inshights-test.assets.json b/...l/test/integ.cloudtrail-insight.js.snapshot/aws-cdk-cloudtrail-inshights-test.assets.json
diff --git a/...test/integ.cloudtrail-insight.js.snapshot/aws-cdk-cloudtrail-inshights-test.template.json b/...test/integ.cloudtrail-insight.js.snapshot/aws-cdk-cloudtrail-inshights-test.template.json
@@ -25,7 +25,8 @@
        "Action": [
         "s3:DeleteObject*",
         "s3:GetBucket*",
-        "s3:List*"
+        "s3:List*",
+        "s3:PutBucketPolicy"
        ],
        "Effect": "Allow",
        "Principal": {
@@ -155,7 +156,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "3e6ea85c994cf2198f02e67a9e98e8f23456efa8bd72dd55b3a86454c4db9d5f.zip"
+     "S3Key": "2ec8ad9e91dcd6e7ad6a5c84ffc6c9c05c408aca3b26ceb2816d81043e6c4dc3.zip"
     },
     "Timeout": 900,
     "MemorySize": 128,
@@ -187,10 +188,6 @@
   "Trail022F0CF2": {
    "Type": "AWS::CloudTrail::Trail",
    "Properties": {
-    "IsLogging": true,
-    "S3BucketName": {
-     "Ref": "S3486F821D"
-    },
     "EnableLogFileValidation": true,
     "EventSelectors": [],
     "IncludeGlobalServiceEvents": true,
@@ -202,7 +199,11 @@
       "InsightType": "ApiErrorRateInsight"
      }
     ],
-    "IsMultiRegionTrail": true
+    "IsLogging": true,
+    "IsMultiRegionTrail": true,
+    "S3BucketName": {
+     "Ref": "S3486F821D"
+    }
    },
    "DependsOn": [
     "S3Policy2E4AA1D6"

diff --git a/...-insight.js.snapshot/awscdkcloudtrailinshightsDefaultTestDeployAssertF7B86FF0.assets.json b/...-insight.js.snapshot/awscdkcloudtrailinshightsDefaultTestDeployAssertF7B86FF0.assets.json
diff --git a/...ing/framework-integ/test/aws-cloudtrail/test/integ.cloudtrail-insight.js.snapshot/cdk.out b/...ing/framework-integ/test/aws-cloudtrail/test/integ.cloudtrail-insight.js.snapshot/cdk.out
diff --git a/.../framework-integ/test/aws-cloudtrail/test/integ.cloudtrail-insight.js.snapshot/integ.json b/.../framework-integ/test/aws-cloudtrail/test/integ.cloudtrail-insight.js.snapshot/integ.json
diff --git a/...amework-integ/test/aws-cloudtrail/test/integ.cloudtrail-insight.js.snapshot/manifest.json b/...amework-integ/test/aws-cloudtrail/test/integ.cloudtrail-insight.js.snapshot/manifest.json
diff --git a/...g/framework-integ/test/aws-cloudtrail/test/integ.cloudtrail-insight.js.snapshot/tree.json b/...g/framework-integ/test/aws-cloudtrail/test/integ.cloudtrail-insight.js.snapshot/tree.json
diff --git a/....snapshot/asset.120f2d9f06d56bd1038e8bb4bc7fa0b1758f62b6c772f4ac166b811e9ed71cf9/index.js b/....snapshot/asset.120f2d9f06d56bd1038e8bb4bc7fa0b1758f62b6c772f4ac166b811e9ed71cf9/index.js
diff --git a/....snapshot/asset.2ec8ad9e91dcd6e7ad6a5c84ffc6c9c05c408aca3b26ceb2816d81043e6c4dc3/index.js b/....snapshot/asset.2ec8ad9e91dcd6e7ad6a5c84ffc6c9c05c408aca3b26ceb2816d81043e6c4dc3/index.js