{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/69","labels_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/69/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/69/comments","events_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/69/events","html_url":"https://github.com/ansible/ansible-modules-core/issues/69","id":44413839,"number":69,"title":"s3: Unnecessary bucket_check condition while getting an object from s3","user":{"login":"gmpuran","id":1169222,"avatar_url":"https://avatars.githubusercontent.com/u/1169222?v=3","gravatar_id":"","url":"https://api.github.com/users/gmpuran","html_url":"https://github.com/gmpuran","followers_url":"https://api.github.com/users/gmpuran/followers","following_url":"https://api.github.com/users/gmpuran/following{/other_user}","gists_url":"https://api.github.com/users/gmpuran/gists{/gist_id}","starred_url":"https://api.github.com/users/gmpuran/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gmpuran/subscriptions","organizations_url":"https://api.github.com/users/gmpuran/orgs","repos_url":"https://api.github.com/users/gmpuran/repos","events_url":"https://api.github.com/users/gmpuran/events{/privacy}","received_events_url":"https://api.github.com/users/gmpuran/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/bug_report","name":"bug_report","color":"fbca04"},{"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/cloud","name":"cloud","color":"c7def8"},{"url":"https://api.github.com/repos/ansible/ansible-modules-core/labels/P3","name":"P3","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2014-09-30T09:06:39Z","updated_at":"2015-03-26T13:32:45Z","closed_at":null,"body":"Hi There,\r\n\r\nI was advised here: https://github.com/ansible/ansible/issues/8123 to open a separate issue on newly separated repos.\r\n\r\nSummary:\r\n\r\nAWS IAM policy enables us to restrict users to specific file or folder in a bucket. While S3 get object operation is successful from other tools, ansible s3 module fails and returns an error Target bucket not found.\r\n\r\nThe operation succeeds when list bucket rights are provided to that IAM user.\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/comments/86514559","html_url":"https://github.com/ansible/ansible-modules-core/issues/69#issuecomment-86514559","issue_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/69","id":86514559,"user":{"login":"gmpuran","id":1169222,"avatar_url":"https://avatars.githubusercontent.com/u/1169222?v=3","gravatar_id":"","url":"https://api.github.com/users/gmpuran","html_url":"https://github.com/gmpuran","followers_url":"https://api.github.com/users/gmpuran/followers","following_url":"https://api.github.com/users/gmpuran/following{/other_user}","gists_url":"https://api.github.com/users/gmpuran/gists{/gist_id}","starred_url":"https://api.github.com/users/gmpuran/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gmpuran/subscriptions","organizations_url":"https://api.github.com/users/gmpuran/orgs","repos_url":"https://api.github.com/users/gmpuran/repos","events_url":"https://api.github.com/users/gmpuran/events{/privacy}","received_events_url":"https://api.github.com/users/gmpuran/received_events","type":"User","site_admin":false},"created_at":"2015-03-26T13:32:45Z","updated_at":"2015-03-26T13:32:45Z","body":"Here you go. As the issue quite old, haven't got a chance to grab version details, but have provided detailed description of the issue.\r\n\r\n##### Issue Type:\r\n\r\nBug Report\r\n\r\n##### Ansible Version:\r\n\r\n\r\n##### Environment:\r\n\r\nN/A\r\n\r\n##### Summary:\r\n\r\nWhile getting an s3 object using ansible s3 module, explicit S3:ListBucket permission is required in IAM, for GET operation to be successful. This additional listing permission should not be required as one can restrict a particular IAM user to specific file or folder in S3 bucket.\r\n\r\n##### Steps To Reproduce:\r\n\r\n1. Create S3 bucket - ansible-s3\r\n\r\n2. Create folder test/ and a file inside that folder test.txt\r\n\r\n3. GET operation command will be:\r\n\r\n\t#### Simple GET operation\r\n\t- s3: bucket=ansible-s3 object=/test/test.txt dest=/usr/local/test.txt mode=get\r\n\r\n4. If IAM policy is kept as follows:\r\n\r\n```json\r\n{\r\n    \"Version\": \"2012-10-17\",\r\n    \"Statement\": [\r\n        {\r\n            \"Sid\": \"Stmt1426510138000\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"s3:*\"\r\n            ],\r\n            \"Resource\": [\r\n                \"arn:aws:s3:::ansible-s3/test\"\r\n            ]\r\n        },\r\n        {\r\n            \"Sid\": \"Stmt1426510160000\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": [\r\n                \"s3:*\"\r\n            ],\r\n            \"Resource\": [\r\n                \"arn:aws:s3:::ansible-s3/test/*\"\r\n            ]\r\n        }\r\n    ]\r\n}\r\n```\r\n\r\n5. Above GET operation will fail, unless S3:ListBucket operation access is provided to this IAM user.\r\n\r\n##### Expected Results:\r\n\r\nThe GET operation should succeed without requiring S3:ListBucket rights.\r\n\r\n##### Actual Results:\r\n\r\nThe GET operation fails unless IAM user has S3:ListBucket rights.\r\n"}}