coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fit Coulomb archive policy within native statement limit

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a17f16-d99c-7ea3-95f0-8212897fba6b
This commit is contained in:
codex 2026-10-29 21:55:33 +01:00
parent 12f2056272
commit 61a82ac74c
2 changed files with 18 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/application_recovery_resources.py
View file

@ -119,8 +119,16 @@ def policy(bucket, prefix, apps, owner):
statements.append(statement(role + "Objects", principal, actions, bucket + "/" + prefix + "/*"))
statements.append(statement(role + "List", principal, ["s3:ListBucket", "s3:ListBucketVersions"],
bucket, {"StringLike": {"s3:prefix": [prefix + "/", prefix + "/*"]}}))
statements.append(statement(role + "Metadata", principal,
["s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration"], bucket))
if prefix != "archives":
statements.append(statement(role + "Metadata", principal,
["s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration"], bucket))
if prefix == "archives":
# Scaleway accepts at most ten statements per policy. These metadata
# rights are identical for all three callers; sharing their statement
# changes no effective permission or prefix restriction.
statements.append(statement("ArchiveMetadata", ["application_id:" + apps[r]
for r in ("reader", "custodian", "publisher")],
["s3:GetBucketLocation", "s3:GetBucketVersioning", "s3:GetLifecycleConfiguration"], bucket))
return {"Version": "2023-04-17", "Id": "coulomb-independent-recovery", "Statement": statements}