Feature/fix conditional iam (#230)

* fix conditional customer iam role policy add conditional iam role when customer condition is empty. * Update CHANGELOG.md
ExpediaGroup · May 30, 2023 · 65e23dd · 65e23dd
1 parent 754d914
commit 65e23dd
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,10 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## [6.18.1] - 2023-05-30
+### Changed
+- Added `conditional_consumer_iamroles` in principles even when customer_condition is empty.
+
 ## [6.18.0] - 2023-05-25
 ### Added
 - Added the annotations to push Prometheus metrics for Hive Metastore R/W and R/O to Datadog UI.

diff --git a/templates/apiary-bucket-policy.json b/templates/apiary-bucket-policy.json
@@ -23,7 +23,11 @@
             "Sid": "Apiary customer account object permissions",
             "Effect": "Allow",
             "Principal": {
+%{if conditional_consumer_iamroles == ""}
                 "AWS": [ "${customer_principal}" ]
+%{else}
+                "AWS": [ "${customer_principal}", "${conditional_consumer_iamroles}" ]
+%{endif}
             },
             "Action": [
                 "s3:GetObject",