fix(cli): scope migrated private/protected S3 access to the caller identity

gen2-migration emitted Gen1 authenticated access on private/{entity_id}/* and
protected/{entity_id}/* using allow.authenticated, so the {entity_id} token was
not bound to the requesting user.

Map Gen1 authenticated access on private/ and protected/ to
allow.entity('identity') so {entity_id} resolves to the caller's Cognito
identity, matching the per-user scoping of the Gen1 configuration. protected/
retains allow.authenticated read access; public/* is unchanged.

Adds a test covering per-user scoping and updates the affected inline snapshots.

Author: ahmedhamouda78

packages/amplify-cli/src/__tests__/commands/gen2-migration/generate/amplify/storage/s3.generator.test.ts

@@ -189,8 +189,11 @@ describe('S3Generator', () => {
         name: \`myBucket-main-\${branchName}\`,
         access: (allow) => ({
           'public/*': [allow.authenticated.to(['read', 'write'])],
-          'protected/{entity_id}/*': [allow.authenticated.to(['read', 'write'])],
-          'private/{entity_id}/*': [allow.authenticated.to(['read', 'write'])],
+          'protected/{entity_id}/*': [
+            allow.entity('identity').to(['read', 'write']),
+            allow.authenticated.to(['read']),
+          ],
+          'private/{entity_id}/*': [allow.entity('identity').to(['read', 'write'])],
         }),
       });
 
@@ -218,6 +221,43 @@ describe('S3Generator', () => {
     `);
   });
 
+  // private/ and protected/ are per-user paths: authenticated access must be scoped to the
+  // caller's own identity via allow.entity('identity'), matching the Gen1 configuration.
+  it('scopes authenticated private/protected access to the caller identity', async () => {
+    const gen1App = await createGen1App({
+      providers: { awscloudformation: { StackName: 'amplify-test-main-123456', Region: 'us-east-1' } },
+      storage: { myBucket: { service: 'S3', output: { BucketName: 'myBucket-main-abc123' } } },
+    });
+    jest.spyOn(gen1App, 'cliInputs').mockReturnValue({
+      authAccess: ['READ', 'CREATE_AND_UPDATE', 'DELETE'],
+      guestAccess: [],
+    });
+    jest.spyOn(gen1App.aws, 'fetchBucketAccelerate').mockResolvedValue(undefined);
+    jest.spyOn(gen1App.aws, 'fetchBucketVersioning').mockResolvedValue(undefined);
+    jest.spyOn(gen1App.aws, 'fetchBucketEncryption').mockResolvedValue(undefined);
+
+    const generator = new S3Generator(
+      gen1App,
+      backendGenerator,
+      outputDir,
+      { category: 'storage', resourceName: 'myBucket', service: 'S3', key: 'storage:S3' },
+      logger,
+    );
+    const ops = await generator.plan();
+    await ops[0].execute();
+    const content = writtenFile('resource.ts');
+    const normalized = content.replace(/\s+/g, ' ');
+
+    // Per-user paths use entity('identity') so {entity_id} maps to the caller's identity.
+    expect(normalized).toMatch(
+      /'private\/\{entity_id\}\/\*':\s*\[\s*allow\.entity\('identity'\)\.to\(\['read', 'write', 'delete'\]\)\s*,?\s*\]/,
+    );
+    expect(normalized).toMatch(/'protected\/\{entity_id\}\/\*':\s*\[\s*allow\.entity\('identity'\)\.to\(\['read', 'write', 'delete'\]\)/);
+
+    // Enforce per-user scoping: private/protected must not grant write/delete via allow.authenticated.
+    expect(content).not.toMatch(/'(private|protected)\/\{entity_id\}\/\*': \[[^\]]*allow\.authenticated\.to\(\[[^\]]*'(write|delete)'/s);
+  });
+
   it('renders guest access patterns', async () => {
     const gen1App = await createGen1App({
       providers: { awscloudformation: { StackName: 'amplify-test-main-123456', Region: 'us-east-1' } },
@@ -324,10 +364,11 @@ describe('S3Generator', () => {
             allow.authenticated.to(['read', 'write', 'delete']),
           ],
           'protected/{entity_id}/*': [
-            allow.authenticated.to(['read', 'write', 'delete']),
+            allow.entity('identity').to(['read', 'write', 'delete']),
+            allow.authenticated.to(['read']),
           ],
           'private/{entity_id}/*': [
-            allow.authenticated.to(['read', 'write', 'delete']),
+            allow.entity('identity').to(['read', 'write', 'delete']),
           ],
         }),
       });
@@ -402,11 +443,12 @@ describe('S3Generator', () => {
             allow.groups(['admin']).to(['read', 'write', 'delete']),
           ],
           'protected/{entity_id}/*': [
+            allow.entity('identity').to(['read']),
             allow.authenticated.to(['read']),
             allow.groups(['admin']).to(['read', 'write', 'delete']),
           ],
           'private/{entity_id}/*': [
-            allow.authenticated.to(['read']),
+            allow.entity('identity').to(['read']),
             allow.groups(['admin']).to(['read', 'write', 'delete']),
           ],
         }),

packages/amplify-cli/src/commands/gen2-migration/generate/amplify/storage/s3.renderer.ts

@@ -280,10 +280,15 @@ export class S3Renderer {
       publicPathAccess.push(this.createAllowPattern(allowIdentifier, 'guest', accessPatterns.guest));
     }
     if (accessPatterns.auth && accessPatterns.auth.length > 0) {
-      const pattern = this.createAllowPattern(allowIdentifier, 'authenticated', accessPatterns.auth);
-      publicPathAccess.push(pattern);
-      protectedPathAccess.push(pattern);
-      privatePathAccess.push(pattern);
+      // public/* is a shared path: authenticated users get the Gen1 auth permission set.
+      publicPathAccess.push(this.createAllowPattern(allowIdentifier, 'authenticated', accessPatterns.auth));
+      // private/ and protected/ are per-user paths. Use allow.entity('identity') so the
+      // {entity_id} token resolves to the caller's own Cognito identity, matching the
+      // per-user scoping of the Gen1 configuration.
+      privatePathAccess.push(this.createEntityPattern(allowIdentifier, accessPatterns.auth));
+      protectedPathAccess.push(this.createEntityPattern(allowIdentifier, accessPatterns.auth));
+      // Gen1 protected/ also grants read to other authenticated users.
+      protectedPathAccess.push(this.createAllowPattern(allowIdentifier, 'authenticated', ['read']));
     }
     if (accessPatterns.groups) {
       for (const [groupName, permissions] of Object.entries(accessPatterns.groups)) {
@@ -352,6 +357,25 @@ export class S3Renderer {
     );
   }
 
+  /**
+   * Renders `allow.entity('identity').to([...])`, which scopes an {entity_id} path to the
+   * caller's own Cognito identity in the generated IAM policy.
+   */
+  private createEntityPattern(allowIdentifier: ts.Identifier, permissions: readonly Permission[]): CallExpression {
+    return factory.createCallExpression(
+      factory.createPropertyAccessExpression(
+        factory.createCallExpression(
+          factory.createPropertyAccessExpression(allowIdentifier, factory.createIdentifier('entity')),
+          undefined,
+          [factory.createStringLiteral('identity')],
+        ),
+        factory.createIdentifier('to'),
+      ),
+      undefined,
+      [factory.createArrayLiteralExpression(permissions.map((p) => factory.createStringLiteral(p)))],
+    );
+  }
+
   private createResourcePattern(allowIdentifier: ts.Identifier, functionName: string, permissions: readonly Permission[]): CallExpression {
     return factory.createCallExpression(
       factory.createPropertyAccessExpression(