Skip to content

Add S3 GetBucketPolicyStatus support - #10214

Open
OmniNomadLLC wants to merge 1 commit into
getmoto:masterfrom
OmniNomadLLC:feature/s3-get-bucket-policy-status
Open

Add S3 GetBucketPolicyStatus support#10214
OmniNomadLLC wants to merge 1 commit into
getmoto:masterfrom
OmniNomadLLC:feature/s3-get-bucket-policy-status

Conversation

@OmniNomadLLC

Copy link
Copy Markdown

What

Implements GetBucketPolicyStatus for S3.

Why

Currently the call falls through to a generic empty response: get_bucket_policy_status returns PolicyStatus: {} regardless of whether the bucket has a policy, and never raises NoSuchBucketPolicy. We ran into this while testing a security-audit tool against moto (a tool that checks whether buckets are public), where the empty response is indistinguishable from a private bucket.

How

  • NoSuchBucketPolicy when the bucket has no policy (matches AWS).
  • IsPublic is computed from the stored policy: an Allow statement with a wildcard principal ("*", {"AWS": "*"} or a list containing "*") and no Condition block makes the policy public. Statements carrying any Condition are treated as non-public, which matches how AWS treats access-restricting condition keys; the full AWS evaluation of which condition keys still count as public is intentionally out of scope and documented as such in the helper.
  • Dispatch and ACTION_MAP entries follow the existing GetBucketPolicy/GetPublicAccessBlock patterns; the response uses the ActionResult serializer.

Tests

Four new tests in tests/test_s3/test_s3_bucket_policy.py: no policy raises NoSuchBucketPolicy; wildcard-principal policy reports IsPublic: True; scoped principal reports False; wildcard with a Condition reports False. Full -k "policy or public_access" subset passes (25 tests), ruff check and ruff format clean.

GetBucketPolicyStatus previously fell through to a generic empty response,
returning PolicyStatus: {} regardless of the bucket's policy. This
implements the action: it returns NoSuchBucketPolicy when the bucket has
no policy, and computes IsPublic based on Allow statements with a
wildcard principal and no Condition block (statements carrying a
Condition are treated as non-public, matching AWS's treatment of
access-restricting condition keys).
@codecov

codecov Bot commented Aug 31, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 81.25000% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.31%. Comparing base (716d6a8) to head (6209f2a).

Files with missing lines Patch % Lines
moto/s3/utils.py 75.00% 6 Missing ⚠️

❌ Your patch check has failed because the patch coverage (81.25%) is below the target coverage (90.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #10214      +/-   ##
==========================================
- Coverage   93.32%   93.31%   -0.01%     
==========================================
  Files        1342     1342              
  Lines      122702   122734      +32     
==========================================
+ Hits       114507   114534      +27     
- Misses       8195     8200       +5     
Flag Coverage Δ
servertests 27.93% <12.50%> (-0.01%) ⬇️
unittests 93.29% <81.25%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant