From 4ea2921d0d03dbc84be57a5ea87ba1d7baca385e Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 8 Oct 2026 23:42:26 +0200 Subject: [PATCH] Refuse to overwrite publisher statements in the backup bucket policy. The original apply script only knows the resource-control statements. It now stops when the live policy has more. Assistant: grok Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54 --- tools/apply-backup-bucket-policy.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tools/apply-backup-bucket-policy.sh b/tools/apply-backup-bucket-policy.sh index d9796ed..67895a0 100755 --- a/tools/apply-backup-bucket-policy.sh +++ b/tools/apply-backup-bucket-policy.sh @@ -134,6 +134,13 @@ client = boto3.client( aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"], aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"], ) +current = json.loads(client.get_bucket_policy(Bucket=bucket)["Policy"]) +extra = sorted({item.get("Sid") for item in current.get("Statement", [])} - {item.get("Sid") for item in policy["Statement"]}) +if extra: + raise SystemExit( + "refusing to replace the bucket policy; live statements are not in this script: " + + ",".join(extra) + ) client.put_bucket_policy(Bucket=bucket, Policy=json.dumps(policy)) print("bucket_policy=put") got = client.get_bucket_policy(Bucket=bucket)