def cloudtrail_policy(original, bucket_name, account_id, bucket_region):
    '''add CloudTrail permissions to an S3 policy, preserving existing'''
    ct_actions = [
        {
            'Action': 's3:GetBucketAcl',
            'Effect': 'Allow',
            'Principal': {'Service': 'cloudtrail.amazonaws.com'},
            'Resource': generate_arn(
                service='s3', resource=bucket_name, region=bucket_region),
            'Sid': 'AWSCloudTrailAclCheck20150319',
        },
        {
            'Action': 's3:PutObject',
            'Condition': {
                'StringEquals':
                {'s3:x-amz-acl': 'bucket-owner-full-control'},
            },
            'Effect': 'Allow',
            'Principal': {'Service': 'cloudtrail.amazonaws.com'},
            'Resource': generate_arn(
                service='s3', resource=bucket_name, region=bucket_region),
            'Sid': 'AWSCloudTrailWrite20150319',
        },
    ]
    # parse original policy
    if original is None:
        policy = {
            'Statement': [],
            'Version': '2012-10-17',
        }
    else:
        policy = json.loads(original['Policy'])
    original_actions = [a.get('Action') for a in policy['Statement']]
    for cta in ct_actions:
        if cta['Action'] not in original_actions:
            policy['Statement'].append(cta)
    return json.dumps(policy)
def cloudtrail_policy ( original , bucket_name , account_id , bucket_region ) : ct_actions = [ { 'Action' : 's3:GetBucketAcl' , 'Effect' : 'Allow' , 'Principal' : { 'Service' : 'cloudtrail.amazonaws.com' } , 'Resource' : generate_arn ( service = 's3' , resource = bucket_name , region = bucket_region ) , 'Sid' : 'AWSCloudTrailAclCheck20150319' , } , { 'Action' : 's3:PutObject' , 'Condition' : { 'StringEquals' : { 's3:x-amz-acl' : 'bucket-owner-full-control' } , } , 'Effect' : 'Allow' , 'Principal' : { 'Service' : 'cloudtrail.amazonaws.com' } , 'Resource' : generate_arn ( service = 's3' , resource = bucket_name , region = bucket_region ) , 'Sid' : 'AWSCloudTrailWrite20150319' , } , ] if original is None : policy = { 'Statement' : [ ] , 'Version' : '2012-10-17' , } else : policy = json . loads ( original [ 'Policy' ] ) original_actions = [ a . get ( 'Action' ) for a in policy [ 'Statement' ] ] for cta in ct_actions : if cta [ 'Action' ] not in original_actions : policy [ 'Statement' ] . append ( cta ) return json . dumps ( policy )
add CloudTrail permissions to an S3 policy, preserving existing