Function newBucketStatement

pkg/policy/bucket-policy.go:157–204

Returns new statements with bucket actions for given policy.

(policy BucketPolicy, bucketName, prefix string)

// Returns new statements with bucket actions for given policy.
func newBucketStatement(policy BucketPolicy, bucketName, prefix string) (statements []Statement) {
	statements = []Statement{}
	if policy == BucketPolicyNone || bucketName == "" {
		return statements
	}

	bucketResource := set.CreateStringSet(awsResourcePrefix + bucketName)

	statement := Statement{
		Actions:   commonBucketActions,
		Effect:    "Allow",
		Principal: User{AWS: set.CreateStringSet("*")},
		Resources: bucketResource,
		Sid:       "",
	}
	statements = append(statements, statement)

	if policy == BucketPolicyReadOnly || policy == BucketPolicyReadWrite {
		statement = Statement{
			Actions:   readOnlyBucketActions,
			Effect:    "Allow",
			Principal: User{AWS: set.CreateStringSet("*")},
			Resources: bucketResource,
			Sid:       "",
		}
		if prefix != "" {
			condKeyMap := make(ConditionKeyMap)
			condKeyMap.Add("s3:prefix", set.CreateStringSet(prefix+"*"))
			condMap := make(ConditionMap)
			condMap.Add("StringLike", condKeyMap)
			statement.Conditions = condMap
		}
		statements = append(statements, statement)
	}

	if policy == BucketPolicyWriteOnly || policy == BucketPolicyReadWrite {
		statement = Statement{
			Actions:   writeOnlyBucketActions,
			Effect:    "Allow",
			Principal: User{AWS: set.CreateStringSet("*")},
			Resources: bucketResource,
			Sid:       "",
		}
		statements = append(statements, statement)
	}

	return statements
}

// Returns new statements contains object actions for given policy.
func newObjectStatement(policy BucketPolicy, bucketName, prefix string) (statements []Statement) {