Function TestSetPolicy

pkg/policy/bucket-policy_test.go:1953–2079

SetPolicy() is called and the result is validated.

(t *testing.T)

// SetPolicy() is called and the result is validated.
func TestSetPolicy(t *testing.T) {
	helloCondMap := make(ConditionMap)
	helloCondKeyMap := make(ConditionKeyMap)
	helloCondKeyMap.Add("s3:prefix", set.CreateStringSet("hello"))
	helloCondMap.Add("StringEquals", helloCondKeyMap)

	testCases := []struct {
		statements     []Statement
		policy         BucketPolicy
		bucketName     string
		prefix         string
		expectedResult string
	}{
		// BucketPolicyNone - empty statements, bucket name and prefix.
		{[]Statement{}, BucketPolicyNone, "", "", `[]`},
		// BucketPolicyNone - non-empty statements, bucket name and prefix.
		{[]Statement{{
			Actions:   readOnlyBucketActions,
			Effect:    "Allow",
			Principal: User{AWS: set.CreateStringSet("*")},
			Resources: set.CreateStringSet("arn:aws:s3:::mybucket"),
		}}, BucketPolicyNone, "", "", `[{"Action":["s3:ListBucket"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::mybucket"],"Sid":""}]`},
		// BucketPolicyNone - empty statements, non-empty bucket name and prefix.
		{[]Statement{}, BucketPolicyNone, "mybucket", "", `[]`},
		// BucketPolicyNone - empty statements, bucket name and non-empty prefix.
		{[]Statement{}, BucketPolicyNone, "", "hello", `[]`},
		// BucketPolicyReadOnly - empty statements, bucket name and prefix.
		{[]Statement{}, BucketPolicyReadOnly, "", "", `[]`},
		// BucketPolicyReadOnly - non-empty statements, bucket name and prefix.
		{[]Statement{{
			Actions:   readOnlyBucketActions,
			Effect:    "Allow",
			Principal: User{AWS: set.CreateStringSet("*")},
			Resources: set.CreateStringSet("arn:aws:s3:::testbucket"),
		}}, BucketPolicyReadOnly, "", "", `[{"Action":["s3:ListBucket"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::testbucket"],"Sid":""}]`},
		// BucketPolicyReadOnly - empty statements, non-empty bucket name and prefix.
		{[]Statement{}, BucketPolicyReadOnly, "mybucket", "", `[{"Action":["s3:GetBucketLocation","s3:ListBucket"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::mybucket"],"Sid":""},{"Action":["s3:GetObject"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::mybucket/*"],"Sid":""}]`},
		// BucketPolicyReadOnly - empty statements, bucket name and non-empty prefix.
		{[]Statement{}, BucketPolicyReadOnly, "", "hello", `[]`},
		// BucketPolicyReadOnly - empty statements, non-empty bucket name and non-empty prefix.
		{[]Statement{}, BucketPolicyReadOnly, "mybucket", "hello", `[{"Action":["s3:GetBucketLocation"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::mybucket"],"Sid":""},{"Action":["s3:ListBucket"],"Condition":{"StringLike":{"s3:prefix":["hello*"]}},"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::mybucket"],"Sid":""},{"Action":["s3:GetObject"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::mybucket/hello*"],"Sid":""}]`},
		// BucketPolicyWriteOnly - empty statements, bucket name and prefix.
		{[]Statement{}, BucketPolicyReadOnly, "", "", `[]`},
		// BucketPolicyWriteOnly - non-empty statements, bucket name and prefix.
		{[]Statement{{
			Actions:   readOnlyBucketActions,
			Effect:    "Allow",
			Principal: User{AWS: set.CreateStringSet("*")},
			Resources: set.CreateStringSet("arn:aws:s3:::testbucket"),
		}}, BucketPolicyWriteOnly, "", "", `[{"Action":["s3:ListBucket"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::testbucket"],"Sid":""}]`},
		// BucketPolicyWriteOnly - empty statements, non-empty bucket name and prefix.
		{[]Statement{}, BucketPolicyWriteOnly, "mybucket", "", `[{"Action":["s3:GetBucketLocation","s3:ListBucketMultipartUploads"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::mybucket"],"Sid":""},{"Action":["s3:AbortMultipartUpload","s3:DeleteObject","s3:ListMultipartUploadParts","s3:PutObject"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::mybucket/*"],"Sid":""}]`},
		// BucketPolicyWriteOnly - empty statements, bucket name and non-empty prefix.
		{[]Statement{}, BucketPolicyWriteOnly, "", "hello", `[]`},
		// BucketPolicyWriteOnly - empty statements, non-empty bucket name and non-empty prefix.
		{[]Statement{}, BucketPolicyWriteOnly, "mybucket", "hello", `[{"Action":["s3:GetBucketLocation","s3:ListBucketMultipartUploads"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::mybucket"],"Sid":""},{"Action":["s3:AbortMultipartUpload","s3:DeleteObject","s3:ListMultipartUploadParts","s3:PutObject"],"Effect":"Allow","Principal":{"AWS":["*"]},"Resource":["arn:aws:s3:::mybucket/hello*"],"Sid":""}]`},
		// BucketPolicyReadWrite - empty statements, bucket name and prefix.
		{[]Statement{}, BucketPolicyReadWrite, "", "", `[]`},