Skip to content

Commit eae5593

Browse files
simonwsimonw
committed
get-public-access-block and set-public-access-block, closes #92 
1 parent ac428b7 commit eae5593

3 files changed

Lines changed: 219 additions & 19 deletions

File tree

‎docs/help.md‎

Lines changed: 71 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -33,25 +33,27 @@ Options:
3333
--help Show this message and exit.
3434
3535
Commands:
36-
create Create and return new AWS credentials for specified...
37-
debug-bucket Run a bunch of diagnostics to help debug a bucket
38-
delete-objects Delete one or more object from an S3 bucket
39-
delete-user Delete specified users, their access keys and their...
40-
get-bucket-policy Get bucket policy for a bucket
41-
get-cors-policy Get CORS policy for a bucket
42-
get-object Download an object from an S3 bucket
43-
get-objects Download multiple objects from an S3 bucket
44-
list-bucket List contents of bucket
45-
list-buckets List buckets
46-
list-roles List roles
47-
list-user-policies List inline policies for specified users
48-
list-users List all users for this account
49-
policy Output generated JSON policy for one or more buckets
50-
put-object Upload an object to an S3 bucket
51-
put-objects Upload multiple objects to an S3 bucket
52-
set-bucket-policy Set bucket policy for a bucket
53-
set-cors-policy Set CORS policy for a bucket
54-
whoami Identify currently authenticated user
36+
create Create and return new AWS credentials for...
37+
debug-bucket Run a bunch of diagnostics to help debug a bucket
38+
delete-objects Delete one or more object from an S3 bucket
39+
delete-user Delete specified users, their access keys and...
40+
get-bucket-policy Get bucket policy for a bucket
41+
get-cors-policy Get CORS policy for a bucket
42+
get-object Download an object from an S3 bucket
43+
get-objects Download multiple objects from an S3 bucket
44+
get-public-access-block Get the public access settings for an S3 bucket
45+
list-bucket List contents of bucket
46+
list-buckets List buckets
47+
list-roles List roles
48+
list-user-policies List inline policies for specified users
49+
list-users List all users for this account
50+
policy Output generated JSON policy for one or more...
51+
put-object Upload an object to an S3 bucket
52+
put-objects Upload multiple objects to an S3 bucket
53+
set-bucket-policy Set bucket policy for a bucket
54+
set-cors-policy Set CORS policy for a bucket
55+
set-public-access-block Configure public access settings for an S3 bucket.
56+
whoami Identify currently authenticated user
5557
```
5658
## s3-credentials create --help
5759

@@ -262,6 +264,25 @@ Options:
262264
-a, --auth FILENAME Path to JSON/INI file containing credentials
263265
--help Show this message and exit.
264266
```
267+
## s3-credentials get-public-access-block --help
268+
269+
```
270+
Usage: s3-credentials get-public-access-block [OPTIONS] BUCKET
271+
272+
Get the public access settings for an S3 bucket
273+
274+
Example usage:
275+
276+
s3-credentials get-public-access-block my-bucket
277+
278+
Options:
279+
--access-key TEXT AWS access key ID
280+
--secret-key TEXT AWS secret access key
281+
--session-token TEXT AWS session token
282+
--endpoint-url TEXT Custom endpoint URL
283+
-a, --auth FILENAME Path to JSON/INI file containing credentials
284+
--help Show this message and exit.
285+
```
265286
## s3-credentials list-bucket --help
266287

267288
```
@@ -540,6 +561,37 @@ Options:
540561
-a, --auth FILENAME Path to JSON/INI file containing credentials
541562
--help Show this message and exit.
542563
```
564+
## s3-credentials set-public-access-block --help
565+
566+
```
567+
Usage: s3-credentials set-public-access-block [OPTIONS] BUCKET
568+
569+
Configure public access settings for an S3 bucket.
570+
571+
Example:
572+
573+
s3-credentials set-public-access-block my-bucket --block-public-acls false
574+
575+
To allow full public access to the bucket, use the --allow-public-access flag:
576+
577+
s3-credentials set-public-access-block my-bucket --allow-public-access
578+
579+
Options:
580+
--block-public-acls BOOLEAN Block public ACLs for the bucket (true/false).
581+
--ignore-public-acls BOOLEAN Ignore public ACLs for the bucket
582+
(true/false).
583+
--block-public-policy BOOLEAN Block public bucket policies (true/false).
584+
--restrict-public-buckets BOOLEAN
585+
Restrict public buckets (true/false).
586+
--allow-public-access Set all public access settings to false
587+
(allows full public access).
588+
--access-key TEXT AWS access key ID
589+
--secret-key TEXT AWS secret access key
590+
--session-token TEXT AWS session token
591+
--endpoint-url TEXT Custom endpoint URL
592+
-a, --auth FILENAME Path to JSON/INI file containing credentials
593+
--help Show this message and exit.
594+
```
543595
## s3-credentials whoami --help
544596

545597
```

‎docs/other-commands.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -603,3 +603,38 @@ Or for the common case of setting a policy to allow GET access to all buckets:
603603
```bash
604604
s3-credentials set-bucket-policy my-bucket --allow-all-get
605605
```
606+
607+
## get-public-access-block
608+
609+
The `get-public-access-block` command displays the current public access block configuration for a bucket:
610+
```bash
611+
s3-credentials get-public-access-block my-bucket
612+
```
613+
Example output:
614+
615+
```json
616+
{
617+
"BlockPublicAcls": false,
618+
"IgnorePublicAcls": false,
619+
"BlockPublicPolicy": false,
620+
"RestrictPublicBuckets": false
621+
}
622+
```
623+
624+
## set-public-access-block
625+
626+
The `set-public-access-block` command can be used to set the public access block configuration for a bucket:
627+
```bash
628+
s3-credentials set-public-access-block my-bucket \
629+
--block-public-acls true \
630+
--ignore-public-acls true \
631+
--block-public-policy true \
632+
--restrict-public-buckets true
633+
```
634+
Each of the above options accepts `true` or `false`.
635+
636+
You can use the `--allow-public-access` shortcut to set everything to `false` in one go:
637+
```bash
638+
s3-credentials set-public-access-block my-bucket \
639+
--allow-public-access
640+
```

‎s3_credentials/cli.py‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1525,6 +1525,119 @@ def delete_objects(bucket, keys, prefix, silent, dry_run, **boto_options):
15251525
)
15261526

15271527

1528+
@cli.command()
1529+
@click.argument("bucket", required=True)
1530+
@common_boto3_options
1531+
def get_public_access_block(bucket, **boto_options):
1532+
"""
1533+
Get the public access settings for an S3 bucket
1534+
1535+
Example usage:
1536+
1537+
s3-credentials get-public-access-block my-bucket
1538+
"""
1539+
s3 = make_client("s3", **boto_options)
1540+
try:
1541+
response = s3.get_public_access_block(Bucket=bucket)
1542+
except botocore.exceptions.ClientError as e:
1543+
raise click.ClickException(e)
1544+
click.echo(json.dumps(response["PublicAccessBlockConfiguration"], indent=4))
1545+
1546+
1547+
@cli.command()
1548+
@click.argument("bucket", required=True)
1549+
@click.option(
1550+
"--block-public-acls",
1551+
type=bool,
1552+
default=None,
1553+
help="Block public ACLs for the bucket (true/false).",
1554+
)
1555+
@click.option(
1556+
"--ignore-public-acls",
1557+
type=bool,
1558+
default=None,
1559+
help="Ignore public ACLs for the bucket (true/false).",
1560+
)
1561+
@click.option(
1562+
"--block-public-policy",
1563+
type=bool,
1564+
default=None,
1565+
help="Block public bucket policies (true/false).",
1566+
)
1567+
@click.option(
1568+
"--restrict-public-buckets",
1569+
type=bool,
1570+
default=None,
1571+
help="Restrict public buckets (true/false).",
1572+
)
1573+
@click.option(
1574+
"--allow-public-access",
1575+
is_flag=True,
1576+
help="Set all public access settings to false (allows full public access).",
1577+
)
1578+
@common_boto3_options
1579+
def set_public_access_block(
1580+
bucket,
1581+
block_public_acls,
1582+
ignore_public_acls,
1583+
block_public_policy,
1584+
restrict_public_buckets,
1585+
allow_public_access,
1586+
**boto_options,
1587+
):
1588+
"""
1589+
Configure public access settings for an S3 bucket.
1590+
1591+
Example:
1592+
1593+
s3-credentials set-public-access-block my-bucket --block-public-acls false
1594+
1595+
To allow full public access to the bucket, use the --allow-public-access flag:
1596+
1597+
s3-credentials set-public-access-block my-bucket --allow-public-access
1598+
"""
1599+
s3 = make_client("s3", **boto_options)
1600+
1601+
# Default public access block configuration
1602+
public_access_block_config = {}
1603+
1604+
if allow_public_access:
1605+
# Set all settings to False if --allow-public-access is provided
1606+
public_access_block_config = {
1607+
"BlockPublicAcls": False,
1608+
"IgnorePublicAcls": False,
1609+
"BlockPublicPolicy": False,
1610+
"RestrictPublicBuckets": False,
1611+
}
1612+
else:
1613+
# Add values only if they are explicitly provided
1614+
if block_public_acls is not None:
1615+
public_access_block_config["BlockPublicAcls"] = block_public_acls
1616+
if ignore_public_acls is not None:
1617+
public_access_block_config["IgnorePublicAcls"] = ignore_public_acls
1618+
if block_public_policy is not None:
1619+
public_access_block_config["BlockPublicPolicy"] = block_public_policy
1620+
if restrict_public_buckets is not None:
1621+
public_access_block_config["RestrictPublicBuckets"] = (
1622+
restrict_public_buckets
1623+
)
1624+
1625+
if not public_access_block_config:
1626+
raise click.ClickException(
1627+
"No valid options provided. Use --help to see available options."
1628+
)
1629+
1630+
# Apply the public access block configuration to the bucket
1631+
s3.put_public_access_block(
1632+
Bucket=bucket, PublicAccessBlockConfiguration=public_access_block_config
1633+
)
1634+
1635+
click.echo(
1636+
f"Updated public access block settings for bucket '{bucket}': {public_access_block_config}",
1637+
err=True,
1638+
)
1639+
1640+
15281641
def output(iterator, headers, nl, csv, tsv):
15291642
if nl:
15301643
for item in iterator:

0 commit comments

Comments
 (0)