Skip to content

Commit 42bc3cb

Browse files
frankynbshaffer
frankyn
authored and
bshaffer
committed
storage: add bucket policy only samples (GoogleCloudPlatform#858)
1 parent f2c7ea3 commit 42bc3cb

8 files changed

+314
-0
lines changed

‎storage/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ This simple command-line application demonstrates how to invoke Google Cloud Sto
4141
object-acl Manage the ACL for Cloud Storage objects
4242
objects Manage Cloud Storage objects
4343
requester-pays Manage Cloud Storage requester pays buckets and objects
44+
bucket-policy-only Manage Cloud Storage bucket policy only buckets
4445
```
4546
6. Run `php storage.php COMMAND --help` to print information about the usage of each command.
4647

‎storage/composer.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,13 @@
1818
"src/delete_bucket_default_acl.php",
1919
"src/delete_object.php",
2020
"src/delete_object_acl.php",
21+
"src/disable_bucket_policy_only.php",
2122
"src/disable_default_event_based_hold.php",
2223
"src/disable_requester_pays.php",
2324
"src/download_encrypted_object.php",
2425
"src/download_file_requester_pays.php",
2526
"src/download_object.php",
27+
"src/enable_bucket_policy_only.php",
2628
"src/enable_default_event_based_hold.php",
2729
"src/enable_default_kms_key.php",
2830
"src/enable_requester_pays.php",
@@ -32,6 +34,7 @@
3234
"src/get_bucket_default_acl.php",
3335
"src/get_bucket_default_acl_for_entity.php",
3436
"src/get_bucket_labels.php",
37+
"src/get_bucket_policy_only.php",
3538
"src/get_object_acl.php",
3639
"src/get_object_acl_for_entity.php",
3740
"src/get_requester_pays_status.php",

‎storage/src/disable_bucket_policy_only.php

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
2+
/**
3+
* Copyright 2019 Google Inc.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/**
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/master/storage/README.md
22+
*/
23+
24+
namespace Google\Cloud\Samples\Storage;
25+
26+
# [START storage_disable_bucket_policy_only]
27+
use Google\Cloud\Storage\StorageClient;
28+
29+
/**
30+
* Enable Bucket Policy Only.
31+
*
32+
* @param string $bucketName Name of your Google Cloud Storage bucket.
33+
*
34+
* @return void
35+
*/
36+
function disable_bucket_policy_only($bucketName)
37+
{
38+
$storage = new StorageClient();
39+
$bucket = $storage->bucket($bucketName);
40+
$bucket->update([
41+
'iamConfiguration' => [
42+
'bucketPolicyOnly' => [
43+
'enabled' => false
44+
]
45+
]
46+
]);
47+
printf('Bucket Policy Only was disabled for %s' . PHP_EOL, $bucketName);
48+
}
49+
# [END storage_disable_bucket_policy_only]

‎storage/src/enable_bucket_policy_only.php

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
2+
/**
3+
* Copyright 2019 Google Inc.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/**
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/master/storage/README.md
22+
*/
23+
24+
namespace Google\Cloud\Samples\Storage;
25+
26+
# [START storage_enable_bucket_policy_only]
27+
use Google\Cloud\Storage\StorageClient;
28+
29+
/**
30+
* Enable Bucket Policy Only.
31+
*
32+
* @param string $bucketName Name of your Google Cloud Storage bucket.
33+
*
34+
* @return void
35+
*/
36+
function enable_bucket_policy_only($bucketName)
37+
{
38+
$storage = new StorageClient();
39+
$bucket = $storage->bucket($bucketName);
40+
$bucket->update([
41+
'iamConfiguration' => [
42+
'bucketPolicyOnly' => [
43+
'enabled' => true
44+
]
45+
]
46+
]);
47+
printf('Bucket Policy Only was enabled for %s' . PHP_EOL, $bucketName);
48+
}
49+
# [END storage_enable_bucket_policy_only]

‎storage/src/get_bucket_policy_only.php

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
2+
/**
3+
* Copyright 2019 Google Inc.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/**
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/master/storage/README.md
22+
*/
23+
24+
namespace Google\Cloud\Samples\Storage;
25+
26+
# [START storage_get_bucket_policy_only]
27+
use Google\Cloud\Storage\StorageClient;
28+
29+
/**
30+
* Enable Bucket Policy Only.
31+
*
32+
* @param string $bucketName Name of your Google Cloud Storage bucket.
33+
*
34+
* @return void
35+
*/
36+
function get_bucket_policy_only($bucketName)
37+
{
38+
$storage = new StorageClient();
39+
$bucket = $storage->bucket($bucketName);
40+
$bucketInformation = $bucket->info();
41+
$bucketPolicyOnly = $bucketInformation['iamConfiguration']['bucketPolicyOnly'];
42+
if ($bucketPolicyOnly['enabled']) {
43+
printf('Bucket Policy Only is enabled for %s' . PHP_EOL, $bucketName);
44+
printf('Bucket Policy Only will be locked on %s' . PHP_EOL, $bucketPolicyOnly['LockedTime']);
45+
} else {
46+
printf('Bucket Policy Only is disabled for %s' . PHP_EOL, $bucketName);
47+
}
48+
}
49+
# [END storage_get_bucket_policy_only]

‎storage/storage.php

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -402,6 +402,32 @@
402402
}
403403
});
404404

405+
$application->add(new Command('bucket-policy-only'))
406+
->setDescription('Manage Cloud Storage bucket policy only buckets.')
407+
->setHelp(<<
408+
The %command.name% command manages Cloud Storage bucket policy only buckets.
409+
410+
php %command.full_name% --help
411+
412+
EOF
413+
)
414+
->addArgument('bucket', InputArgument::REQUIRED, 'The Cloud Storage Bucket Policy Only bucket name')
415+
->addOption('enable', null, InputOption::VALUE_NONE, 'Enable Bucket Policy Only on a Cloud Storage bucket')
416+
->addOption('disable', null, InputOption::VALUE_NONE, 'Disable Bucket Policy Only on a Cloud Storage bucket')
417+
->addOption('get', null, InputOption::VALUE_NONE, 'Get Bucket Policy Only on a Cloud Storage bucekt')
418+
->setCode(function ($input, $output) {
419+
$bucketName = $input->getArgument('bucket');
420+
if ($input->getOption('enable')) {
421+
enable_bucket_policy_only($bucketName);
422+
} elseif ($input->getOption('disable')) {
423+
disable_bucket_policy_only($bucketName);
424+
} elseif ($input->getOption('get')) {
425+
get_bucket_policy_only($bucketName);
426+
} else {
427+
throw new \Exception('You must provide --enable, --disable, or --get with a bucket name.');
428+
}
429+
});
430+
405431
$application->add(new Command('enable-default-kms-key'))
406432
->setDescription('Enable default KMS encryption for a bucket.')
407433
->setHelp(<<

‎storage/test/BucketPolicyOnlyCommandTest.php

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
2+
/**
3+
* Copyright 2019 Google Inc.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
namespace Google\Cloud\Samples\Storage\Tests;
19+
20+
use Google\Cloud\Storage\StorageClient;
21+
use Symfony\Component\Console\Tester\CommandTester;
22+
23+
/**
24+
* Unit Tests for BucketPolicyOnlyCommand.
25+
*/
26+
class BucketPolicyOnlyCommandTest extends \PHPUnit_Framework_TestCase
27+
{
28+
protected static $hasCredentials;
29+
protected $commandTester;
30+
protected $storage;
31+
protected $bucket;
32+
33+
public static function setUpBeforeClass()
34+
{
35+
$path = getenv('GOOGLE_APPLICATION_CREDENTIALS');
36+
self::$hasCredentials = $path && file_exists($path) &&
37+
filesize($path) > 0;
38+
}
39+
40+
public function setUp()
41+
{
42+
// Sleep to avoid the rate limit for creating/deleting.
43+
sleep(5 + rand(2, 4));
44+
$application = require __DIR__ . '/../storage.php';
45+
$this->commandTester = new CommandTester($application->get('bucket-policy-only'));
46+
$this->storage = new StorageClient();
47+
if (!self::$hasCredentials) {
48+
$this->markTestSkipped('No application credentials were found.');
49+
}
50+
51+
// Append random because tests for multiple PHP versions were running at the same time.
52+
$bucketName = 'php-bucket-policy-only-' . time() . '-' . rand(1000, 9999);
53+
$this->bucket = $this->storage->createBucket($bucketName);
54+
}
55+
56+
public function tearDown()
57+
{
58+
$this->bucket->delete();
59+
}
60+
61+
public function testEnableBucketPolicyOnly()
62+
{
63+
$this->commandTester->execute(
64+
[
65+
'bucket' => $this->bucket->name(),
66+
'--enable' => true,
67+
],
68+
['interactive' => false]
69+
);
70+
$outputString = <<
71+
Bucket Policy Only was enabled for {$this->bucket->name()}
72+
73+
EOF;
74+
$this->expectOutputString($outputString);
75+
$this->bucket->reload();
76+
$bucketInformation = $this->bucket->info();
77+
$bucketPolicyOnly = $bucketInformation['iamConfiguration']['bucketPolicyOnly'];
78+
$this->assertTrue($bucketPolicyOnly['enabled']);
79+
}
80+
81+
/** @depends testEnableBucketPolicyOnly */
82+
public function testDisableBucketPolicyOnly()
83+
{
84+
$this->commandTester->execute(
85+
[
86+
'bucket' => $this->bucket->name(),
87+
'--disable' => true,
88+
],
89+
['interactive' => false]
90+
);
91+
92+
$outputString = <<
93+
Bucket Policy Only was disabled for {$this->bucket->name()}
94+
95+
EOF;
96+
$this->expectOutputString($outputString);
97+
$this->bucket->reload();
98+
$bucketInformation = $this->bucket->info();
99+
$bucketPolicyOnly = $bucketInformation['iamConfiguration']['bucketPolicyOnly'];
100+
$this->assertFalse($bucketPolicyOnly['enabled']);
101+
}
102+
103+
/** @depends testDisableBucketPolicyOnly */
104+
public function testGetBucketPolicyOnly()
105+
{
106+
$this->commandTester->execute(
107+
[
108+
'bucket' => $this->bucket->name(),
109+
'--get' => true,
110+
],
111+
['interactive' => false]
112+
);
113+
114+
$outputString = <<
115+
Bucket Policy Only is disabled for {$this->bucket->name()}
116+
117+
EOF;
118+
$this->expectOutputString($outputString);
119+
$this->bucket->reload();
120+
$bucketInformation = $this->bucket->info();
121+
$bucketPolicyOnly = $bucketInformation['iamConfiguration']['bucketPolicyOnly'];
122+
$this->assertFalse($bucketPolicyOnly['enabled']);
123+
}
124+
}

‎storage/test/IamCommandTest.php

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
namespace Google\Cloud\Samples\Storage\Tests;
1919

2020
use Google\Cloud\Samples\Storage\IamCommand;
21+
use Google\Cloud\Core\Iam\PolicyBuilder;
2122
use Google\Cloud\Storage\StorageClient;
2223
use Symfony\Component\Console\Tester\CommandTester;
2324

@@ -59,6 +60,18 @@ public function testAddBucketIamMember()
5960
$bucket = $this->bucket;
6061
$role = 'roles/storage.objectViewer';
6162
$user = $this->user;
63+
64+
// clean up bucket IAM policy
65+
$policy = $this->storage->bucket($bucket)->iam()->policy();
66+
foreach ($policy['bindings'] as $binding) {
67+
if ($binding['role'] == $role && in_array($user, $binding['members'])) {
68+
$policyBuilder = new PolicyBuilder($policy);
69+
$policyBuilder->removeBinding($role, [$user]);
70+
$this->storage->bucket($bucket)->iam()->setPolicy($policyBuilder->result());
71+
break;
72+
}
73+
}
74+
6275
$this->commandTester->execute(
6376
[
6477
'bucket' => $bucket,

0 commit comments

Comments
 (0)