Skip to content

Commit 2f44960

Browse files
adanajaadanaja
authored
Merge pull request #230 from adanaja/feat
Add read/write_trusted_accounts parameters
2 parents 4b2ac7a + 6ca7c26 commit 2f44960

File tree

3 files changed

+228
-4
lines changed

3 files changed

+228
-4
lines changed

‎src/e3/aws/troposphere/s3/__init__.py‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,12 @@ def __init__(
2222
name: str,
2323
iam_names_prefix: str,
2424
iam_path: str,
25-
trusted_accounts: list[str],
25+
trusted_accounts: list[str] | None = None,
2626
iam_read_root_name: str = "Read",
2727
iam_write_root_name: str = "Write",
2828
bucket_exists: bool | None = None,
29+
read_trusted_accounts: list[str] | None = None,
30+
write_trusted_accounts: list[str] | None = None,
2931
**bucket_kwargs: Any,
3032
) -> None:
3133
"""Initialize BucketWithRoles instance.
@@ -37,11 +39,19 @@ def __init__(
3739
:param iam_read_root_name: root name for read access roles and policy
3840
:param iam_write_root_name: root name for write access roles and policy
3941
:param bucket_exists: if True then the bucket is not created
42+
:param read_trusted_accounts: additional trusted accounts for read access
43+
:param write_trusted_accounts: additional trusted accounts for write access
4044
:param bucket_kwargs: keyword arguments to pass to the bucket constructor
4145
"""
4246
self.name = name
4347
self.iam_names_prefix = iam_names_prefix
44-
self.trusted_accounts = trusted_accounts
48+
self.trusted_accounts = trusted_accounts if trusted_accounts is not None else []
49+
self.read_trusted_accounts = (
50+
read_trusted_accounts if read_trusted_accounts is not None else []
51+
)
52+
self.write_trusted_accounts = (
53+
write_trusted_accounts if write_trusted_accounts is not None else []
54+
)
4555
self.bucket_exists = bucket_exists
4656

4757
self.bucket = Bucket(name=self.name, **bucket_kwargs)
@@ -57,7 +67,7 @@ def __init__(
5767
self.read_role = Role(
5868
name=f"{self.iam_names_prefix}{iam_read_root_name}Role",
5969
description=f"Role with read access to {self.name} bucket.",
60-
trust=Trust(accounts=self.trusted_accounts),
70+
trust=Trust(accounts=self.trusted_accounts + self.read_trusted_accounts),
6171
managed_policy_arns=[self.read_policy.arn],
6272
path=iam_path,
6373
)
@@ -75,7 +85,7 @@ def __init__(
7585
self.push_role = Role(
7686
name=f"{self.iam_names_prefix}{iam_write_root_name}Role",
7787
description=f"Role with read and write access to {self.name} bucket.",
78-
trust=Trust(accounts=self.trusted_accounts),
88+
trust=Trust(accounts=self.trusted_accounts + self.write_trusted_accounts),
7989
managed_policy_arns=[self.push_policy.arn, self.read_policy.arn],
8090
path=iam_path,
8191
)

‎tests/tests_e3_aws/troposphere/s3/bucket-with-roles-trusted-accounts.json‎

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
{
2+
"TestBucketWithRoles": {
3+
"Properties": {
4+
"BucketName": "test-bucket-with-roles",
5+
"BucketEncryption": {
6+
"ServerSideEncryptionConfiguration": [
7+
{
8+
"ServerSideEncryptionByDefault": {
9+
"SSEAlgorithm": "AES256"
10+
}
11+
}
12+
]
13+
},
14+
"PublicAccessBlockConfiguration": {
15+
"BlockPublicAcls": true,
16+
"BlockPublicPolicy": true,
17+
"IgnorePublicAcls": true,
18+
"RestrictPublicBuckets": true
19+
},
20+
"VersioningConfiguration": {
21+
"Status": "Enabled"
22+
}
23+
},
24+
"Type": "AWS::S3::Bucket"
25+
},
26+
"TestBucketWithRolesPolicy": {
27+
"Properties": {
28+
"Bucket": {
29+
"Ref": "TestBucketWithRoles"
30+
},
31+
"PolicyDocument": {
32+
"Version": "2012-10-17",
33+
"Statement": [
34+
{
35+
"Effect": "Deny",
36+
"Principal": {
37+
"AWS": "*"
38+
},
39+
"Action": "s3:*",
40+
"Resource": "arn:aws:s3:::test-bucket-with-roles/*",
41+
"Condition": {
42+
"Bool": {
43+
"aws:SecureTransport": "false"
44+
}
45+
}
46+
},
47+
{
48+
"Effect": "Deny",
49+
"Principal": {
50+
"AWS": "*"
51+
},
52+
"Action": "s3:PutObject",
53+
"Resource": "arn:aws:s3:::test-bucket-with-roles/*",
54+
"Condition": {
55+
"StringNotEquals": {
56+
"s3:x-amz-server-side-encryption": "AES256"
57+
}
58+
}
59+
},
60+
{
61+
"Effect": "Deny",
62+
"Principal": {
63+
"AWS": "*"
64+
},
65+
"Action": "s3:PutObject",
66+
"Resource": "arn:aws:s3:::test-bucket-with-roles/*",
67+
"Condition": {
68+
"Null": {
69+
"s3:x-amz-server-side-encryption": "true"
70+
}
71+
}
72+
}
73+
]
74+
}
75+
},
76+
"Type": "AWS::S3::BucketPolicy"
77+
},
78+
"TestBucketRestorePolicy": {
79+
"Properties": {
80+
"Description": "Grants read access permissions to test-bucket-with-roles bucket",
81+
"ManagedPolicyName": "TestBucketRestorePolicy",
82+
"PolicyDocument": {
83+
"Version": "2012-10-17",
84+
"Statement": [
85+
{
86+
"Effect": "Allow",
87+
"Action": [
88+
"s3:GetObject"
89+
],
90+
"Resource": "arn:aws:s3:::test-bucket-with-roles/*"
91+
},
92+
{
93+
"Effect": "Allow",
94+
"Action": [
95+
"s3:ListBucket"
96+
],
97+
"Resource": "arn:aws:s3:::test-bucket-with-roles"
98+
}
99+
]
100+
},
101+
"Path": "/test/"
102+
},
103+
"Type": "AWS::IAM::ManagedPolicy"
104+
},
105+
"TestBucketRestoreRole": {
106+
"Properties": {
107+
"RoleName": "TestBucketRestoreRole",
108+
"Description": "Role with read access to test-bucket-with-roles bucket.",
109+
"ManagedPolicyArns": [
110+
{
111+
"Ref": "TestBucketRestorePolicy"
112+
}
113+
],
114+
"AssumeRolePolicyDocument": {
115+
"Version": "2012-10-17",
116+
"Statement": [
117+
{
118+
"Effect": "Allow",
119+
"Action": "sts:AssumeRole",
120+
"Principal": {
121+
"AWS": [
122+
"arn:aws:iam::123456789:root"
123+
]
124+
}
125+
}
126+
]
127+
},
128+
"Tags": [
129+
{
130+
"Key": "Name",
131+
"Value": "TestBucketRestoreRole"
132+
}
133+
],
134+
"Path": "/test/"
135+
},
136+
"Type": "AWS::IAM::Role"
137+
},
138+
"TestBucketPushPolicy": {
139+
"Properties": {
140+
"Description": "Grants write access permissions to test-bucket-with-roles bucket",
141+
"ManagedPolicyName": "TestBucketPushPolicy",
142+
"PolicyDocument": {
143+
"Version": "2012-10-17",
144+
"Statement": [
145+
{
146+
"Effect": "Allow",
147+
"Action": [
148+
"s3:PutObject",
149+
"s3:DeleteObject"
150+
],
151+
"Resource": "arn:aws:s3:::test-bucket-with-roles/*"
152+
}
153+
]
154+
},
155+
"Path": "/test/"
156+
},
157+
"Type": "AWS::IAM::ManagedPolicy"
158+
},
159+
"TestBucketPushRole": {
160+
"Properties": {
161+
"RoleName": "TestBucketPushRole",
162+
"Description": "Role with read and write access to test-bucket-with-roles bucket.",
163+
"ManagedPolicyArns": [
164+
{
165+
"Ref": "TestBucketPushPolicy"
166+
},
167+
{
168+
"Ref": "TestBucketRestorePolicy"
169+
}
170+
],
171+
"AssumeRolePolicyDocument": {
172+
"Version": "2012-10-17",
173+
"Statement": [
174+
{
175+
"Effect": "Allow",
176+
"Action": "sts:AssumeRole",
177+
"Principal": {
178+
"AWS": [
179+
"arn:aws:iam::987654321:root"
180+
]
181+
}
182+
}
183+
]
184+
},
185+
"Tags": [
186+
{
187+
"Key": "Name",
188+
"Value": "TestBucketPushRole"
189+
}
190+
],
191+
"Path": "/test/"
192+
},
193+
"Type": "AWS::IAM::Role"
194+
}
195+
}

‎tests/tests_e3_aws/troposphere/s3/s3_test.py‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,25 @@ def test_bucket_with_roles_exists(stack: Stack) -> None:
8787
assert stack.export()["Resources"] == expected_template
8888

8989

90+
def test_bucket_with_roles_trusted_accounts(stack: Stack) -> None:
91+
"""Test BucketWithRoles with additional trusted accounts."""
92+
bucket = BucketWithRoles(
93+
name="test-bucket-with-roles",
94+
iam_names_prefix="TestBucket",
95+
iam_read_root_name="Restore",
96+
iam_write_root_name="Push",
97+
iam_path="/test/",
98+
read_trusted_accounts=["123456789"],
99+
write_trusted_accounts=["987654321"],
100+
)
101+
stack.add(bucket)
102+
103+
with open(os.path.join(TEST_DIR, "bucket-with-roles-trusted-accounts.json")) as fd:
104+
expected_template = json.load(fd)
105+
106+
assert stack.export()["Resources"] == expected_template
107+
108+
90109
def test_bucket_multi_encryption(stack: Stack) -> None:
91110
"""Test bucket accepting multiple types of encryptions and without default."""
92111
bucket = Bucket(

0 commit comments

Comments
 (0)