Add support for wildcards in consumer iam roles (#220)

* support for consumer role wildcard * update changelog Co-authored-by: Raj Poluri <[email protected]>
ExpediaGroup · Jul 25, 2022 · 0bb7fd4 · 0bb7fd4
1 parent 6f76701
commit 0bb7fd4
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 4 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,10 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## [6.14.2] - 2022-07-19
+### Changed
+- Add support for wildcards in consumer iam roles.
+
 ## [6.14.1] - 2022-07-19
 ### Fixed
 - Fix k8s metastore cpu limits.

diff --git a/templates/apiary-bucket-policy.json b/templates/apiary-bucket-policy.json
@@ -89,9 +89,7 @@
         {
             "Sid": "Apiary consumer iamrole permissions",
             "Effect": "Allow",
-            "Principal": {
-                "AWS": [ "${consumer_iamroles}" ]
-            },
+            "Principal": "*",
             "Action": [
                 "s3:GetBucketLocation",
                 "s3:GetObject",
@@ -102,7 +100,12 @@
             "Resource": [
                 "arn:aws:s3:::${bucket_name}",
                 "arn:aws:s3:::${bucket_name}/*"
-            ]
+            ],
+            "Condition": {
+              "StringLike": {
+                "aws:PrincipalArn": [ "${consumer_iamroles}" ]
+              }
+            }
         },
 %{endif}
 %{if producer_iamroles != ""}