Forem: Cristian Francisco Meoño Canel

How to Unlock S3 Bucket Policy in a Organization Member Account

Cristian Francisco Meoño Canel — Fri, 17 Jan 2025 05:16:16 +0000

While working on a POC I accidentally set a bucket policy like this one ...

{
    "Version": "2012-10-17",
    "Statement": [{
        "Action": "s3:*",
        "Effect": "Deny",
        "Resource": [
            "arn:aws:s3:::dummybucket",
            "arn:aws:s3:::dummybucket/*"
        ],
        "Principal": "*"
    }]
}

Yeah ... That's the problem of copy&paste and a barely edit without double check. A policy that caused a bunch of errors and locked me out of the bucket, even though I had an AdministratorAccess policy.

Initially, I thought the fix would be easy—just delete the bucket policy using root access. But there was a catch, the bucket was in an account that’s part of an AWS Organization, and by default, member accounts don’t have root credentials.

After some research and trial and error, I found the solution. I’m sharing it here to save you some time if you ever find yourself in the same situation!

Log in to the AWS Console using the management account ( the one that manages AWS Organization).
Enable Centralized root access for member accounts at IAM Console

After enabling root access, reload the page, select the account with the misconfigured bucket, and choose the Take Privileged Action option.

Choose Delete Amazon S3 bucket policy, select the affected bucket, and remove the problematic policy.

And that's it, a simple and quick solution to what can be a headache.

Optionally disable Centralized root access for member accounts

Go Design Patterns : Observer

Cristian Francisco Meoño Canel — Thu, 02 Jun 2022 01:36:05 +0000

It is a behavior pattern that allows us to have a group of objects (observers) subscribed to another object (observable).

It is usually used to notify observers of the occurrence of an event.

The Goroutines provide us an quite efficient way to implement this design pattern.

Let's see this example.

First, we need to implement our observable object, this will have an array of observers.

In this example our observable object will be a "Topic" this will notify his observers of the availability of a product.

type Topic struct {
    Observers []Observer
    Name      string
    Available bool
}

//Constructor
func NewTopic(name string) *Topic {
    return &Topic{
        Name: name,
    }
}

//Update 'Available' value and notify it to Observers
func (i *Topic) UpdateAvailable(value bool) {
    i.Available = value
    i.Broadcast()
}

//Using Goroutines, will notify each observer of the array
func (i *Topic) Broadcast() {
    var wg sync.WaitGroup
    for _, obj := range i.Observers {
        wg.Add(1)
        go func(observer Observer) {
            defer wg.Done()
            observer.Notify(i.Name, i.Available)
        }(obj)
    }
    wg.Wait()
}

//Add a new observer to the array
func (i *Topic) Register(observer Observer) {
    i.Observers = append(i.Observers, observer)
}

Then we need to define how "looks" our observer objects, this objects can have differents behaviors, in OOP we would usually use an abstract class for the Observer, in Go we can use an Interface where each object needs to implement in order to be an Observer.

In this example exists to types of Observers, EmailClient and SMSClient

type Observer interface {
    GetId() string //Id Getter
    Notify(name string, value bool) //Send the notification
}

type EmailClient struct {
    id string
}

func (eC *EmailClient) GetId() string {
    return eC.id
}

func (eC *EmailClient) Notify(name string, value bool) {

    if value {
        fmt.Printf("Sending email - %s available to client %s\n", name, eC.id)
    } else {
        fmt.Printf("Sending email - %s not available to client %s\n", name, eC.id)
    }

}

type SMSClient struct {
    id string
}

func (sC *SMSClient) GetId() string {
    return sC.id
}

func (sC *SMSClient) Notify(name string, value bool) {

    if value {
        fmt.Printf("Sending SMS - %s available to client %s\n", name, sC.id)
    } else {
        fmt.Printf("Sending SMS - %s not available to client %s\n", name, sC.id)
    }

}

Running Our Code

func main() {
    nvidiaTopic := NewTopic("RTX 3080")
    firstObserver := &EmailClient{
        id: "100",
    }
    secondObserver := &SMSClient{
        id: "200",
    }
    nvidiaTopic.Register(firstObserver)
    nvidiaTopic.Register(secondObserver)
    nvidiaTopic.UpdateAvailable(true)
    nvidiaTopic.UpdateAvailable(false)
}

Output

Sending SMS - RTX 3080 available to client 200
Sending email - RTX 3080 available to client 100
Sending SMS - RTX 3080 not available to client 200
Sending email - RTX 3080 not available to client 100

Program exited.

Full Example

package main

import (
    "fmt"
    "sync"
)

type Topic struct {
    Observers []Observer
    Name      string
    Available bool
}

//Constructor
func NewTopic(name string) *Topic {
    return &Topic{
        Name: name,
    }
}

//Update 'Available' value and notify it to Observers
func (i *Topic) UpdateAvailable(value bool) {
    i.Available = value
    i.Broadcast()
}

//Using Goroutines, will notify each observer of the array
func (i *Topic) Broadcast() {
    var wg sync.WaitGroup
    for _, obj := range i.Observers {
        wg.Add(1)
        go func(observer Observer) {
            defer wg.Done()
            observer.Notify(i.Name, i.Available)
        }(obj)
    }
    wg.Wait()
}

//Add a new observer to the array
func (i *Topic) Register(observer Observer) {
    i.Observers = append(i.Observers, observer)
}

type Observer interface {
    GetId() string                  //Id Getter
    Notify(name string, value bool) //Send the notification
}

type EmailClient struct {
    id string
}

func (eC *EmailClient) GetId() string {
    return eC.id
}

func (eC *EmailClient) Notify(name string, value bool) {

    if value {
        fmt.Printf("Sending email - %s available to client %s\n", name, eC.id)
    } else {
        fmt.Printf("Sending email - %s not available to client %s\n", name, eC.id)
    }

}

type SMSClient struct {
    id string
}

func (sC *SMSClient) GetId() string {
    return sC.id
}

func (sC *SMSClient) Notify(name string, value bool) {

    if value {
        fmt.Printf("Sending SMS - %s available to client %s\n", name, sC.id)
    } else {
        fmt.Printf("Sending SMS - %s not available to client %s\n", name, sC.id)
    }

}

func main() {
    nvidiaTopic := NewTopic("RTX 3080")
    firstObserver := &EmailClient{
        id: "100",
    }
    secondObserver := &SMSClient{
        id: "200",
    }
    nvidiaTopic.Register(firstObserver)
    nvidiaTopic.Register(secondObserver)
    nvidiaTopic.UpdateAvailable(true)
    nvidiaTopic.UpdateAvailable(false)
}

And that's all, see you for another post.

Go Design Patterns : Factory

Cristian Francisco Meoño Canel — Fri, 20 May 2022 23:32:07 +0000

It is a creational pattern that allows us to create a "factory" of objects from a base class and to implement polymorphic behaviors that allow us to modify the behavior of the inherited classes.

It is usually used to reuse the creation logic that shares a series of objects.

Go is not strictly an object-oriented language, but we can implement OOP logic through interfaces and the concept of composition over inheritance.

Example
We have a series of products (objects) that behave in a similar way. We can either make a separate class for each one or put all this logic in a base class to create inherited classes for each product.

First, we need to define an interface that describes the behaviors of our products "made" by our "factory".

type IProduct interface {
    setStock(stock int)
    getStock() int
    setName(name string)
    getName() string
}

Define how our product look, then implement the IProduct methods in order to comply with the interface. This is similar to define an abstract class.

type Computer struct {
    name  string
    stock int
}

func (c *Computer) setStock(stock int) {
    c.stock = stock
}

func (c *Computer) getStock() int {
    return c.stock
}

func (c *Computer) setName(name string) {
    c.name = name
}

func (c *Computer) getName() string {
    return c.name
}

Create our product classes that are inherited from the Computer class. Here the concept of composition over inheritance is applied.

type Laptop struct {
    Computer
}

func newLaptop() IProduct {
    return &Laptop{
        Computer: Computer{
            name:  "Laptop Computer",
            stock: 0,
        },
    }
}

type Desktop struct {
    Computer
}

func newDesktop() IProduct {
    return &Desktop{
        Computer: Computer{
            name:  "Desktop Computer",
            stock: 0,
        },
    }
}

Finally, we need to "create" our factory method, this method will return a instance of the object specified.

func GetComputerFactory(computerType string) (IProduct, error) {
    if computerType == "laptop" {
        return newLaptop(), nil
    } else if computerType == "desktop" {
        return newDesktop(), nil
    } else {
        return nil, fmt.Errorf("invalid computer type")
    }
}

Running our code

func PrintNameAndStock(p IProduct) {
    fmt.Printf("Product name: %s, with stock %d\n", p.getName(), p.getStock())
}

func main() {
    laptop, _ := GetComputerFactory("laptop")
    desktop, _ := GetComputerFactory("desktop")

    laptop.setStock(10)
    PrintNameAndStock(laptop)
    desktop.setStock(20)
    PrintNameAndStock(desktop)

}

Output

Product name: Laptop Computer, with stock 10
Product name: Desktop Computer, with stock 20

Full Example

package main

import "fmt"

type IProduct interface {
    setStock(stock int)
    getStock() int
    setName(name string)
    getName() string
}

type Computer struct {
    name  string
    stock int
}

func (c *Computer) setStock(stock int) {
    c.stock = stock
}

func (c *Computer) getStock() int {
    return c.stock
}

func (c *Computer) setName(name string) {
    c.name = name
}

func (c *Computer) getName() string {
    return c.name
}

type Laptop struct {
    Computer
}

func newLaptop() IProduct {
    return &Laptop{
        Computer: Computer{
            name:  "Laptop Computer",
            stock: 0,
        },
    }
}

type Desktop struct {
    Computer
}

func newDesktop() IProduct {
    return &Desktop{
        Computer: Computer{
            name:  "Desktop Computer",
            stock: 0,
        },
    }
}

func GetComputerFactory(computerType string) (IProduct, error) {
    if computerType == "laptop" {
        return newLaptop(), nil
    } else if computerType == "desktop" {
        return newDesktop(), nil
    } else {
        return nil, fmt.Errorf("invalid computer type")
    }
}

func PrintNameAndStock(p IProduct) {
    fmt.Printf("Product name: %s, with stock %d\n", p.getName(), p.getStock())
}

func main() {
    laptop, _ := GetComputerFactory("laptop")
    desktop, _ := GetComputerFactory("desktop")

    laptop.setStock(10)
    PrintNameAndStock(laptop)
    desktop.setStock(20)
    PrintNameAndStock(desktop)
}

I hope I have helped you 😊😊