VED-1029: Set ACL when copying extended attributes files. (#1199)

mfjarvis · dlzhry2nhs · commit 0fc98d4de32c · 2026-02-24T18:17:56.000Z
* VED-1029: Set ACL when copying extended attributes files.

* VED-1029: Allow PutObjectAcl action.

* VED-1029: Change VPCE policy to allow PutObjectAcl action.
diff --git a/infrastructure/account/endpoints.tf b/infrastructure/account/endpoints.tf
@@ -98,7 +98,8 @@ resource "aws_vpc_endpoint" "s3_endpoint" {
           "s3:PutObject",
           "s3:ListBucket",
           "s3:CopyObject",
-          "s3:DeleteObject"
+          "s3:DeleteObject",
+          "s3:PutObjectAcl"
         ]
         Resource = "*"
       }
diff --git a/infrastructure/instance/file_name_processor.tf b/infrastructure/instance/file_name_processor.tf
@@ -166,7 +166,8 @@ resource "aws_iam_policy" "filenameprocessor_lambda_exec_policy" {
       {
         "Effect" : "Allow",
         "Action" : [
-          "s3:PutObject"
+          "s3:PutObject",
+          "s3:PutObjectAcl"
         ],
         "Resource" : ["arn:aws:s3:::${var.dspp_submission_s3_bucket_name}/*"]
       }
diff --git a/lambdas/shared/src/common/aws_s3_utils.py b/lambdas/shared/src/common/aws_s3_utils.py
@@ -30,6 +30,7 @@ def copy_file_to_external_bucket(
         Key=destination_key,
         ExpectedBucketOwner=expected_bucket_owner,
         ExpectedSourceBucketOwner=expected_source_bucket_owner,
+        ACL="bucket-owner-full-control",
     )
 
 

Original file line number	Diff line number	Diff line change
`@@ -98,7 +98,8 @@ resource "aws_vpc_endpoint" "s3_endpoint" {`
`98`	`98`	`"s3:PutObject",`
`99`	`99`	`"s3:ListBucket",`
`100`	`100`	`"s3:CopyObject",`
`101`		`- "s3:DeleteObject"`
	`101`	`+ "s3:DeleteObject",`
	`102`	`+ "s3:PutObjectAcl"`
`102`	`103`	`]`
`103`	`104`	`Resource = "*"`
`104`	`105`	`}`
Original file line number	Diff line number	Diff line change
`@@ -166,7 +166,8 @@ resource "aws_iam_policy" "filenameprocessor_lambda_exec_policy" {`
`166`	`166`	`{`
`167`	`167`	`"Effect" : "Allow",`
`168`	`168`	`"Action" : [`
`169`		`- "s3:PutObject"`
	`169`	`+ "s3:PutObject",`
	`170`	`+ "s3:PutObjectAcl"`
`170`	`171`	`],`
`171`	`172`	`"Resource" : ["arn:aws:s3:::${var.dspp_submission_s3_bucket_name}/*"]`
`172`	`173`	`}`
Original file line number	Diff line number	Diff line change
`@@ -30,6 +30,7 @@ def copy_file_to_external_bucket(`
`30`	`30`	`Key=destination_key,`
`31`	`31`	`ExpectedBucketOwner=expected_bucket_owner,`
`32`	`32`	`ExpectedSourceBucketOwner=expected_source_bucket_owner,`
	`33`	`+ ACL="bucket-owner-full-control",`
`33`	`34`	`)`
`34`	`35`
`35`	`36`