ACL checks are not sufficient for checking access. Access is falsely denied when bucket policy is used.

[electricsam]

Pull Request Description

Using ACLs to check for object access is not sufficient. The bucket policy can override the ACL. This can be a problem when accessing a public bucket in a different account where ACLs are not configured. In general, AWS recommends using bucket policies over ACLs.

These changes remove the ACL check and simply check if object exists for the given user. If that user cannot read or write to that object, an error will happen at the time of that action.

Acceptance Test

• Building the code with mvn clean install -Pintegration-tests still works.

Questions

• Does this pull request break backward compatibility?

  • Yes
  • No

• Does this pull request require other pull requests to be merged first?

  • Yes, please see #...
  • No

• Does this require an update of the documentation?

  • Yes, please see [provide details here]
  • No

[carlspring]

Hi @electricsam ,

Thank you for your contribution!

Would you mind signing the ICLA, as described in the Legal section of our wiki?

Also, please, feel free to join our chat channel, if you'd like to learn more about the project and/or like to find out what else you could help with.

Kind regards,

Martin

[carlspring]

@ptirador , @elerch, @markjschreiber, @pditommaso ,

Could you please review this? :)

[electricsam]

Hi Martin, I filled out the ICLA and sent it. Cheers, Chris Chris Slater Lead Software Engineer Cooperative Institute for Research in Environmental Sciences (CIRES) at University of Colorado Boulder and NOAA National Centers for Environmental Information 325 Broadway, NOAA E/GC3 Boulder, Colorado 80305-3337 E-mail: christopher.r.slater@colorado.edu<mailto:christopher.r.slater@colorado.edu> Office: 1B605, NOAA David Skaggs Research Center On Dec 10, 2020, at 9:08 AM, Martin Todorov <notifications@github.com<mailto:notifications@github.com>> wrote: Hi @electricsam<https://github.com/electricsam> , Thank you for your contribution! Would you mind signing the ICLA<https://5fbab373a589ce000892cbd9--s3fs-nio.netlify.app/assets/resources/pdfs/ICLA.pdf>, as described in the Legal<https://s3fs-nio.carlspring.org/contributing/legal/> section of our wiki? Also, please, feel free to join our chat channel<https://chat.carlspring.org/channel/s3fs-nio-community>, if you'd like to learn more about the project and/or like to find out what else you could help with. Kind regards, Martin — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#133 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ABN2AKPL6KGLKG65VBHBNE3SUDXBLANCNFSM4UVBZVFA>.

[carlspring]

Thanks a lot, @electricsam ! I can confirm I have received it. )

[carlspring]

@electricsam ,

Thanks for this pull request! Would you mind applying the cosmetic code style changes I have raised?

Many thanks in advance! :)

[ptirador]

HI @electricsam,

Thanks for this pull request! Would you mind applying the changes that I requested?
Apart from these, LGTM!

CC @carlspring

[carlspring]

LGTM! :)

[carlspring]

Thank you very much, @electricsam! Congratulations on your first pull request with our project! :)