Public Read write access to the buckets where resources are uploaded. about taskcat

[tonynv]

It depends on how the cfn is structured. If your userdata is using curl to pull file then yes public read is needed.
You can also add a existing private bucket and IAM roles to your cfn.
If the s3bucket is specified in the config.yml then taskcat will not create a bucket.

global:
  owner: [email protected]
  project: sample-cloudformation-project <- Must match the root directory of project (usually the name of git repo)
  s3bucket: projectx-templates

[pankajvkulkarni]

I am using existing bucket, I am using IAM profile to run the task cat the this role does not have "s3:PutObjectAcl".

How about this for the existing bucket.
https://github.com/aws-quickstart/taskcat/blob/master/taskcat/stacker.py#L349

s3_client.upload_file(filename, self.get_s3bucket(), upload, ExtraArgs={'ACL': 'public-read'})

My account admin does not want me to grant public-read permissions on any objects in s3

[tonynv]

You can skip the upload by commenting the stage call as a workaround.
https://github.com/aws-quickstart/taskcat/blob/master/taskcat.py#L43

[pankajvkulkarni]

ok, Thanks,
Can you please make this as command line parameter where we skip upload s3 and just test ?

[tonynv]

Yes good idea, I will add that to the feature roadmap

[tonynv]

Depends on #59

[andrew-glenn]

@pankajvkulkarni,

The permissions issues have been addressed in pull #67, via issue #59. Your feature request for the additional parameter to skip S3 has been moved to #68 .

Edit: Can't close since this issue isn't resolved. Upstream blockers are addressed though.

[tonynv]

Issue Fixed in #72 👍