s3: bucket.grantRead does not allow s3:HeadObject

[tmokmss]

Describe the bug

Currently bucket.grantRead does not allow s3:HeadObject action. Because of this, the code like below does not work if you set the IAM policy by grantRead method, which is a surprising behavior.

s3 = boto3.client("s3")
# this operation requires s3:HeadObject permission
s3.download_file(bucket, key, filepath)

# you get the following error:
# [ERROR] ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden

Expected Behavior

bucket.grantRead allows s3:HeadObject action.

Current Behavior

bucket.grantRead only allows s3:GetBucket* , s3:GetObject*, s3:List* actions.

Reproduction Steps

    const bucket = new Bucket(this, 'Bucket', {
    });
    const role = new Role(this, 'Role', {
      assumedBy: new ServicePrincipal('sns.amazonaws.com'),
    });
    bucket.grantRead(role);
    // See the synthesized IAM policy.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.99.1

Framework Version

2.99.1

Node.js Version

v18.13.0

OS

macOS

Language

Typescript

Language Version

No response

Other information

No response

[khushail]

Hi @tmokmss , thanks for the report on the permitted actions for grantRead().

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[andresionek91]

Your authorization issue was related to something else. s3:HeadObject is not a valid action in IAM.