sts: test get_object() before put_object() so there are no ACLs

some session policy tests try get_object() after put_object() to test
differences between session- and role policy, but put_object() adds ACLs
that already grant access for get_object()

change the order and test get_object() first so there is no object ACL,
and test for 403 vs 404 to see whether it was denied by policy

Signed-off-by: Casey Bodley <[email protected]>

Author: cbodley

s3tests/functional/test_sts.py

@@ -1080,16 +1080,15 @@ def test_session_policy_bucket_policy_role_arn():
                 endpoint_url=default_endpoint,
                 region_name='',
                 )
+
+    # GetObject for nonexistent object should be denied by session policy
+    e = assert_raises(ClientError, s3_client.get_object, Bucket=bucket_name_1, Key="test-1.txt")
+    assert (403, 'AccessDenied') == _get_status_and_error_code(e.response)
+
     bucket_body = 'this is a test file'
     s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
     assert s3_put_obj['ResponseMetadata']['HTTPStatusCode'] == 200
 
-    try:
-        obj = s3_client.get_object(Bucket=bucket_name_1, Key="test-1.txt")
-    except ClientError as e:
-        s3object_error = e.response.get("Error", {}).get("Code")
-    assert s3object_error == 'AccessDenied'
-
     oidc_remove=iam_client.delete_open_id_connect_provider(
     OpenIDConnectProviderArn=oidc_arn
     )
@@ -1156,14 +1155,15 @@ def test_session_policy_bucket_policy_session_arn():
                 endpoint_url=default_endpoint,
                 region_name='',
                 )
+
+    # GetObject for nonexistent object should be allowed by bucket policy
+    e = assert_raises(ClientError, s3_client.get_object, Bucket=bucket_name_1, Key="test-1.txt")
+    assert (404, 'NoSuchKey') == _get_status_and_error_code(e.response)
+
     bucket_body = 'this is a test file'
     s3_put_obj = s3_client.put_object(Body=bucket_body, Bucket=bucket_name_1, Key="test-1.txt")
     assert s3_put_obj['ResponseMetadata']['HTTPStatusCode'] == 200
 
-
-    s3_get_obj = s3_client.get_object(Bucket=bucket_name_1, Key="test-1.txt")
-    assert s3_get_obj['ResponseMetadata']['HTTPStatusCode'] == 200
-
     oidc_remove=iam_client.delete_open_id_connect_provider(
     OpenIDConnectProviderArn=oidc_arn
     )