Fix s3 list objects operation for conditional_consumer_iamroles (#231)

ExpediaGroup · Jun 1, 2023 · a2702e6 · a2702e6
1 parent 65e23dd
commit a2702e6
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,10 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## [6.18.2] - 2023-06-01
+### Fixed
+- `conditional_consumer_iamroles` were not able to list objects within a buckets.
+
 ## [6.18.1] - 2023-05-30
 ### Changed
 - Added `conditional_consumer_iamroles` in principles even when customer_condition is empty.

diff --git a/templates/apiary-bucket-policy.json b/templates/apiary-bucket-policy.json
@@ -7,7 +7,11 @@
             "Sid": "Apiary customer account bucket permissions",
             "Effect": "Allow",
             "Principal": {
+%{if conditional_consumer_iamroles == ""}
                 "AWS": [ "${customer_principal}" ]
+%{else}
+                "AWS": [ "${customer_principal}", "${conditional_consumer_iamroles}" ]
+%{endif}
             },
             "Action": [
                 "s3:GetBucketLocation",