Policy with ${aws:username} is not evaluating properly. Policy with 'red' does. about arsenal

[LaurenSpiegel]

I just tested this and it works as expected for me.

Red getting access denied to list black's objects:

lhs:~/ $ aws s3api list-objects --bucket mybucket --prefix home/black/  --endpoint-url http://localhost:8000

A client error (AccessDenied) occurred when calling the ListObjects operation: Access Denied

Red getting access to list red's objects (make sure you have "/" after "red" in the prefix):

lhs:~/ $ aws s3api list-objects --bucket mybucket --prefix home/red/  --endpoint-url http://localhost:8000
None
CONTENTS    "d41d8cd98f00b204e9800998ecf8427e"  home/red/file1  2016-08-29T17:18:26.539Z    0   STANDARD
OWNER   test    F962T22H86EDEMBV97U5OYUMTP4E9DERWNGH1XZVVLUKNIMNO4NGPMNQ3O9YMTJF
CONTENTS    "d41d8cd98f00b204e9800998ecf8427e"  home/red/file2  2016-08-29T17:18:29.350Z    0   STANDARD
OWNER   test    F962T22H86EDEMBV97U5OYUMTP4E9DERWNGH1XZVVLUKNIMNO4NGPMNQ3O9YMTJF

Also, note for seeing that red has permission on listing the whole bucket or anything with the home/ prefix, you must include a delimiter of "/" in the listing request (red only gets to see the rolled up results). I tested and our behavior is the same as AWS.

Red gets access denied for general listing without delimiter:

lhs:~/ $ aws s3api list-objects --bucket mybucket --prefix home/  --endpoint-url http://localhost:8000

A client error (AccessDenied) occurred when calling the ListObjects operation: Access Denied

Red gets access for general listing with delimiter:

lhs:~/ $ aws s3api list-objects --bucket mybucket --prefix "" --delimiter / --endpoint-url http://localhost:8000
COMMONPREFIXES  home/
CONTENTS    "d41d8cd98f00b204e9800998ecf8427e"  home    2016-08-29T17:18:12.507Z    0   STANDARD
OWNER   test    F962T22H86EDEMBV97U5OYUMTP4E9DERWNGH1XZVVLUKNIMNO4NGPMNQ3O9YMTJF
lhs:~/ $ aws s3api list-objects --bucket mybucket --prefix home/ --delimiter / --endpoint-url http://localhost:8000
COMMONPREFIXES  home/black/
COMMONPREFIXES  home/red/
CONTENTS    "d41d8cd98f00b204e9800998ecf8427e"  home/black  2016-08-29T17:18:35.477Z    0   STANDARD
OWNER   test    F962T22H86EDEMBV97U5OYUMTP4E9DERWNGH1XZVVLUKNIMNO4NGPMNQ3O9YMTJF
CONTENTS    "d41d8cd98f00b204e9800998ecf8427e"  home/red    2016-08-29T17:18:21.223Z    0   STANDARD
OWNER   test    F962T22H86EDEMBV97U5OYUMTP4E9DERWNGH1XZVVLUKNIMNO4NGPMNQ3O9YMTJF

[LaurenSpiegel]

Here are the expected results for black as well:

Access denied to list red's objects:

lhs:~/ $ aws s3api list-objects --bucket mybucket --prefix home/red/  --endpoint-url http://localhost:8000

A client error (AccessDenied) occurred when calling the ListObjects operation: Access Denied
lhs:~/ $ aws s3api list-objects --bucket mybucket --prefix home/red  --endpoint-url http://localhost:8000

A client error (AccessDenied) occurred when calling the ListObjects operation: Access Denied

Access granted to list black's objects:

lhs:~/ $ aws s3api list-objects --bucket mybucket --prefix home/black/  --endpoint-url http://localhost:8000
None
CONTENTS    "d41d8cd98f00b204e9800998ecf8427e"  home/black/file1    2016-08-29T17:18:41.011Z    0   STANDARD
OWNER   test    F962T22H86EDEMBV97U5OYUMTP4E9DERWNGH1XZVVLUKNIMNO4NGPMNQ3O9YMTJF
CONTENTS    "d41d8cd98f00b204e9800998ecf8427e"  home/black/file2    2016-08-29T17:18:43.423Z    0   STANDARD
OWNER   test    F962T22H86EDEMBV97U5OYUMTP4E9DERWNGH1XZVVLUKNIMNO4NGPMNQ3O9YMTJF

[dkilcy]

I still owe you guys the results of my test.

[rahulreddy]

@dkilcy I am closing the issue for now. Please feel free to re-open if you are able to reproduce the bug.