fix: fix iam permissions to retrieve logs from aws s3

[agido-heppe]

Signed-off-by: Lukas Heppe lukas.heppe@agido.com

Fixes #TODO

Please do not open a pull request until you have checked ALL of these:

• Create the PR as draft .
• Run make pre-commit -B to fix codegen and lint problems.
• Sign-off your commits (otherwise the DCO check will fail).
• Use a conventional commit message (otherwise the commit message check will fail).
• "Fixes #" is in both the PR title (for release notes) and this description (to automatically link and close the issue).
• Add unit or e2e tests. Say how you tested your changes. If you changed the UI, attach screenshots.
• Github checks are green.
• Once required tests have passed, mark your PR "Ready for review".

If changes were requested, and you've made them, dismiss the review to get it reviewed again.

Description

When using the IAM policy provided in the docs I couldn't view the logs via UI. By allowing the ListBucket Policy on the bucket instead of the objects within, I was able to retrieve those.

The prinicple is also described in the AWS Blog post https://aws.amazon.com/de/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/.

[terrytangyuan]

What's the difference?

[agido-heppe]

It's the same problem as in the SO post below. You are allowed to perform actions on the resources (objects) within the bucket (marked by the wildcard *), but you are not allowed to list the bucket itself.

If you want to access the logs of some worklfow via UI, the S3 client seems to try to perform a "ListBucket" operation, but it is not allowed to do so. Therefore, this policy explicitly whitelists this action. I will try to find the respective codeline later.

https://stackoverflow.com/questions/38774798/accessdenied-for-listobjects-for-s3-bucket-when-permissions-are-s3

[juliev0]

Thank you for helping to figure out what the right policy settings should be! What you've written makes sense to me.

[terrytangyuan]

Thanks for clarifying!

[agido-heppe]

You are welcome! Thank you providing such nice projects 👍