Repository navigation
Say when --local reads a region never synced; open_buckets checks ACLs only - #3
Merged
Merged
Conversation
…s ACLs only list --local warned only when nothing at all had been synced for the profile and region. The global files from a sync of another region counted, so `list instances --local -r eu-west-1` after a sync of us-west-2 answered an empty list with no hint. The check is now per service file. In JSON the hint is a plain stderr note, as the inspectors' are, so a caller that drops log lines still sees it. open_buckets reads ACL grants only. It now says so in its notes and its text output, so an empty answer does not read as "no bucket is public".
Release notes in docs/release-v0.6.1.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things that gave a wrong impression when reading the synced copy through
--format json.list --localin a region that was never synced. The "nothing has been synced" hint only fired when the profile had no synced files at all. After syncing us-west-2,global/access.ntexists, solist instances --local -r eu-west-1printed[]and nothing else, which looks like "no instances" when it means "never looked". The check is now per service file (sync.ServiceSyncedFor), so the hint names the service and the region. In JSON mode it goes to stderr as a plain line, same as the inspectors' notes, rather than as an[info]log line that a caller filtering logs would drop.open_bucketsonly reads ACLs. It looks for AllUsers / AuthenticatedUsers grants. Buckets are usually opened through bucket policies these days, which it doesn't read, and neither does it read Block Public Access. So now it says that in its notes (JSON) and under its text output. Actually checking policies is a bigger change, for later.Tests: a new end-to-end test for the region case (text and JSON), a unit test for
ServiceSyncedFor, and one for the open_buckets note. All three failed before the change.go test ./...andgo vetpass.