You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "seanghaeli (via GitHub)" <gi...@apache.org> on 2026/05/15 00:00:43 UTC
[PR] Fix s3_tables system test: dynamically build valid bucket policy [airflow]
seanghaeli opened a new pull request, #66972:
URL: https://github.com/apache/airflow/pull/66972
## Summary
Fix the `example_s3_tables` system test by replacing the empty policy statement with a dynamically-built valid one.
The S3 Tables `PutTableBucketPolicy` API rejects:
- Empty `Statement` arrays (malformed)
- Public policies (`Principal: *`)
Added a `@task` that builds the policy at runtime using `sts:GetCallerIdentity` to get the account ID, producing a valid non-public policy.
## Test plan
- [x] Ran system test against this branch — passes (build `7fe776b1`)
- [x] Verified no hardcoded account IDs in the code
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Opus 4.6)
Generated-by: Claude Code (Opus 4.6) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix s3_tables system test: dynamically build valid bucket policy [airflow]
Posted by "o-nikolas (via GitHub)" <gi...@apache.org>.
o-nikolas commented on code in PR #66972:
URL: https://github.com/apache/airflow/pull/66972#discussion_r3245011875
##########
providers/amazon/tests/system/amazon/aws/example_s3_tables.py:
##########
@@ -87,7 +90,7 @@ def create_namespace(table_bucket_arn: str, namespace: str):
put_policy = S3TablesPutTableBucketPolicyOperator(
task_id="put_table_bucket_policy",
table_bucket_arn=create_table_bucket.output,
- resource_policy='{"Version":"2012-10-17","Statement":[]}',
+ resource_policy=f'{{"Version":"2012-10-17","Statement":[{{"Sid":"TestPolicy","Effect":"Allow","Principal":{{"AWS":"arn:aws:iam::{account_id}:root"}},"Action":"s3tables:GetTable","Resource":"*"}}]}}',
Review Comment:
Huh, I wonder how @john-jac had this pass when he locally tested it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix s3_tables system test: dynamically build valid bucket policy [airflow]
Posted by "seanghaeli (via GitHub)" <gi...@apache.org>.
seanghaeli commented on code in PR #66972:
URL: https://github.com/apache/airflow/pull/66972#discussion_r3245036827
##########
providers/amazon/tests/system/amazon/aws/example_s3_tables.py:
##########
@@ -87,7 +90,7 @@ def create_namespace(table_bucket_arn: str, namespace: str):
put_policy = S3TablesPutTableBucketPolicyOperator(
task_id="put_table_bucket_policy",
table_bucket_arn=create_table_bucket.output,
- resource_policy='{"Version":"2012-10-17","Statement":[]}',
+ resource_policy=f'{{"Version":"2012-10-17","Statement":[{{"Sid":"TestPolicy","Effect":"Allow","Principal":{{"AWS":"arn:aws:iam::{account_id}:root"}},"Action":"s3tables:GetTable","Resource":"*"}}]}}',
Review Comment:
Not sure about that, fails on my end without populating the Statement field
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix s3_tables system test: dynamically build valid bucket policy [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck merged PR #66972:
URL: https://github.com/apache/airflow/pull/66972
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org