{"action":"created","issue":{"url":"https://api.github.com/repos/aws/aws-sdk-net/issues/225","labels_url":"https://api.github.com/repos/aws/aws-sdk-net/issues/225/labels{/name}","comments_url":"https://api.github.com/repos/aws/aws-sdk-net/issues/225/comments","events_url":"https://api.github.com/repos/aws/aws-sdk-net/issues/225/events","html_url":"https://github.com/aws/aws-sdk-net/issues/225","id":98440824,"number":225,"title":"S3 PutBucketPolicy - Unable to Grant Read-Only Permission to an Anonymous User","user":{"login":"dbasilio","id":8311284,"avatar_url":"https://avatars.githubusercontent.com/u/8311284?v=3","gravatar_id":"","url":"https://api.github.com/users/dbasilio","html_url":"https://github.com/dbasilio","followers_url":"https://api.github.com/users/dbasilio/followers","following_url":"https://api.github.com/users/dbasilio/following{/other_user}","gists_url":"https://api.github.com/users/dbasilio/gists{/gist_id}","starred_url":"https://api.github.com/users/dbasilio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dbasilio/subscriptions","organizations_url":"https://api.github.com/users/dbasilio/orgs","repos_url":"https://api.github.com/users/dbasilio/repos","events_url":"https://api.github.com/users/dbasilio/events{/privacy}","received_events_url":"https://api.github.com/users/dbasilio/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aws/aws-sdk-net/labels/Bug","name":"Bug","color":"e11d21"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-31T17:51:35Z","updated_at":"2015-08-13T15:25:44Z","closed_at":"2015-08-13T15:25:44Z","body":"in the example bucket policies listed here: http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html It specifies you can put a principal like the following:\r\n`\"Principal\": \"*\"`\r\nThe SDK has AllUsers, but this creates a principal like the following:\r\n`\"Principal\": { \"AWS\": \"*\" }`\r\nThere is currently no way to create a principal specifying only the anonymous user through the sdk. Policy.FromJson can parse this kind of principal into an empty list. When trying to create a policy with an empty list for Principal the .toJson doesn't put a principal in the string, which throws an error when attempting to Put it.\r\nThe main difference is that if we put an explicit Deny in the policy for `\"*\"`, our IAM user can still make requests against that bucket. If `{ \"AWS\": \"*\" }` is used, our IAM user is included in those users who are rejected.\r\n"},"comment":{"url":"https://api.github.com/repos/aws/aws-sdk-net/issues/comments/130728643","html_url":"https://github.com/aws/aws-sdk-net/issues/225#issuecomment-130728643","issue_url":"https://api.github.com/repos/aws/aws-sdk-net/issues/225","id":130728643,"user":{"login":"jimfl","id":511810,"avatar_url":"https://avatars.githubusercontent.com/u/511810?v=3","gravatar_id":"","url":"https://api.github.com/users/jimfl","html_url":"https://github.com/jimfl","followers_url":"https://api.github.com/users/jimfl/followers","following_url":"https://api.github.com/users/jimfl/following{/other_user}","gists_url":"https://api.github.com/users/jimfl/gists{/gist_id}","starred_url":"https://api.github.com/users/jimfl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimfl/subscriptions","organizations_url":"https://api.github.com/users/jimfl/orgs","repos_url":"https://api.github.com/users/jimfl/repos","events_url":"https://api.github.com/users/jimfl/events{/privacy}","received_events_url":"https://api.github.com/users/jimfl/received_events","type":"User","site_admin":false},"created_at":"2015-08-13T15:25:44Z","updated_at":"2015-08-13T15:25:44Z","body":"This has been addressed in the referenced commit, and was included in yesterday's release.\r\n\r\nThe change adds a static `Anonymous` Principal instance which should serialize as `\"Principal\" : \"*'\"`, as well as making the documentation a little more clear and adding some constants for federated and service principals."}}