Question

I have a custom AMI that failed half way through the upload using ec2-upload-bundle but the remaining items were uploaded via the AWS control panel. However, this means that about half of the bundled parts of the bucket are missing the “za-team” grantee which appears to be required for the AMI to launch successfully. How can I go about applying the relevant “Open/Download” permissions to the “za-team” in bulk to the files that are missing it in the bucket?

Answer 1

This took me a little while to figure out as I’m new to Ruby; however, the following loops over all of the files in the bucket and appends the permissions indicated on the files. The relevant SDK documentation on the acl.grant command gives a bit of information on what the script is doing.

#!/usr/bin/ruby

# -----------------------------------------------------------------------------
# This script provides a means of updating all of the files in an S3 bucket to
# have the correct permissions. As this script is effectively throwaway it 
# doesn't do much beyond making sure it runs at least once, however, is worth
# keeping around as a reference in the event the problem arises again.
# -----------------------------------------------------------------------------
require 'rubygems'
require 'aws-sdk'

# The following is the Amazon ID for the za-team group which is used for EC2
# operations in S3 buckets
za_team = '6aa5a366c34c1cbe25dc49211496e913e0351eb0e8c37aa3477e40942ec6b97c'

# Note the configuration points
AWS.config({
  :access_key_id => '[Access Key Here]',
  :secret_access_key => '[Secret Access Key Here]',
})
bucket_name = '[Bucket Name Here]'

# Get the bucket information
s3 = AWS::S3.new
bucket = s3.buckets[bucket_name]

# Update the ACL for each item in the bucket
bucket.objects.each do |object| 
  puts object.key
  acl = object.acl
  acl.grant(:read).
      to(:canonical_user_id => za_team)
  object.acl = acl.to_xml
end