Skip to content

Ensure the ArtifactsLoggingBucket denies non ssl requests #2976

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
elbayaaa merged 1 commit into from
Jun 23, 2021
Merged

Ensure the ArtifactsLoggingBucket denies non ssl requests #2976

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions samcli/lib/pipeline/bootstrap/environment_resources.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -199,15 +199,15 @@ Resources:
Type: AWS::S3::BucketPolicy
Condition: MissingArtifactsBucket
Properties:
Bucket: !Ref ArtifactsBucket
Bucket: !Ref ArtifactsLoggingBucket
PolicyDocument:
Statement:
- Effect: "Deny"
Action: "s3:*"
Principal: "*"
Resource:
- !Join [ '',[ !GetAtt ArtifactsBucket.Arn, '/*' ] ]
- !GetAtt ArtifactsBucket.Arn
- !Join [ '',[ !GetAtt ArtifactsLoggingBucket.Arn, '/*' ] ]
- !GetAtt ArtifactsLoggingBucket.Arn
Condition:
Bool:
aws:SecureTransport: false
Expand Down
17 changes: 9 additions & 8 deletions tests/integration/pipeline/test_bootstrap_command.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,7 +248,8 @@ def test_interactive_pipeline_user_only_created_once(self):
else:
self.assertIn("skipping creation", stdout)

def test_bootstrapped_artifacts_bucket_accepts_ssl_requests_only(self):
@parameterized.expand([("ArtifactsBucket",), ("ArtifactsLoggingBucket",)])
def test_bootstrapped_buckets_accept_ssl_requests_only(self, bucket_logical_id):
env_name, stack_name = self._get_env_and_stack_name()
self.stack_names = [stack_name]

Expand All @@ -261,27 +262,27 @@ def test_bootstrapped_artifacts_bucket_accepts_ssl_requests_only(self):
self.assertEqual(bootstrap_process_execute.process.returncode, 0)

stack_resources = self.cf_client.describe_stack_resources(StackName=stack_name)
artifacts_bucket = next(
bucket = next(
resource
for resource in stack_resources["StackResources"]
if resource["LogicalResourceId"] == "ArtifactsBucket"
if resource["LogicalResourceId"] == bucket_logical_id
)
artifacts_bucket_name = artifacts_bucket["PhysicalResourceId"]
artifacts_bucket_key = "any/testing/key.txt"
bucket_name = bucket["PhysicalResourceId"]
bucket_key = "any/testing/key.txt"
testing_data = b"any testing binary data"

s3_ssl_client = boto3.client("s3")
s3_non_ssl_client = boto3.client("s3", use_ssl=False)

# Assert SSL requests are accepted
s3_ssl_client.put_object(Body=testing_data, Bucket=artifacts_bucket_name, Key=artifacts_bucket_key)
res = s3_ssl_client.get_object(Bucket=artifacts_bucket_name, Key=artifacts_bucket_key)
s3_ssl_client.put_object(Body=testing_data, Bucket=bucket_name, Key=bucket_key)
res = s3_ssl_client.get_object(Bucket=bucket_name, Key=bucket_key)
retrieved_data = res["Body"].read()
self.assertEqual(retrieved_data, testing_data)

# Assert non SSl requests are denied
with self.assertRaises(ClientError) as error:
s3_non_ssl_client.get_object(Bucket=artifacts_bucket_name, Key=artifacts_bucket_key)
s3_non_ssl_client.get_object(Bucket=bucket_name, Key=bucket_key)
self.assertEqual(
str(error.exception), "An error occurred (AccessDenied) when calling the GetObject operation: Access Denied"
)
Expand Down