Function getBucketPolicy

pkg/policy/bucket-policy.go:485–535

Returns policy of given bucket statement.

(statement Statement, prefix string)

// Returns policy of given bucket statement.
func getBucketPolicy(statement Statement, prefix string) (commonFound, readOnly, writeOnly bool) {
	if statement.Effect != "Allow" || !statement.Principal.AWS.Contains("*") {
		return commonFound, readOnly, writeOnly
	}

	if statement.Actions.Intersection(commonBucketActions).Equals(commonBucketActions) &&
		statement.Conditions == nil {
		commonFound = true
	}

	if statement.Actions.Intersection(writeOnlyBucketActions).Equals(writeOnlyBucketActions) &&
		statement.Conditions == nil {
		writeOnly = true
	}

	if statement.Actions.Intersection(readOnlyBucketActions).Equals(readOnlyBucketActions) {
		if prefix != "" && statement.Conditions != nil {
			if stringEqualsValue, ok := statement.Conditions["StringEquals"]; ok {
				if s3PrefixValues, ok := stringEqualsValue["s3:prefix"]; ok {
					if s3PrefixValues.Contains(prefix) {
						readOnly = true
					}
				}
			} else if stringNotEqualsValue, ok := statement.Conditions["StringNotEquals"]; ok {
				if s3PrefixValues, ok := stringNotEqualsValue["s3:prefix"]; ok {
					if !s3PrefixValues.Contains(prefix) {
						readOnly = true
					}
				}
			} else if stringLikeValue, ok := statement.Conditions["StringLike"]; ok {
				if s3PrefixValues, ok := stringLikeValue["s3:prefix"]; ok {
					if s3PrefixValues.Contains(prefix + "*") {
						readOnly = true
					}
				}
			} else if stringNotLikeValue, ok := statement.Conditions["StringNotLike"]; ok {
				if s3PrefixValues, ok := stringNotLikeValue["s3:prefix"]; ok {
					if !s3PrefixValues.Contains(prefix + "*") {
						readOnly = true
					}
				}
			}
		} else if prefix == "" && statement.Conditions == nil {
			readOnly = true
		} else if prefix != "" && statement.Conditions == nil {
			readOnly = true
		}
	}

	return commonFound, readOnly, writeOnly
}

// Returns policy of given object statement.
func getObjectPolicy(statement Statement) (readOnly, writeOnly bool) {