#!/usr/bin/env python
"""
This script will create a presigned url and fields for POSTING to an s3 bucket. This allows someone without permissions
on the bucket to upload a file.

This script must be run by an entity with the right permissions on the bucket.

The url will expire after 600 seconds.

Usage:
scripts/generate-s3-post-url-data.py <bucket> <filename>

"""
import json
import boto3
from docopt import docopt


def generate_s3_post_data(bucket, filename):
    s3 = boto3.client('s3')

    fields = {"acl": "private"}
    conditions = [
        {"acl": "private"}
    ]

    post = s3.generate_presigned_post(
        Bucket=bucket,
        Key=filename,
        Fields=fields,
        Conditions=conditions,
        ExpiresIn=600
    )

    return json.dumps(post)

if __name__ == "__main__":
    arguments = docopt(__doc__)
    bucket = arguments['<bucket>']
    filename = arguments['<filename>']
    print(generate_s3_post_data(bucket, filename))

#!/usr/bin/env python
"""
This script will create a presigned url and fields for POSTING to an s3 bucket. This allows someone without permissions
on the bucket to upload a file.

This script must be run by an entity with the right permissions on the bucket.

The url will expire after 600 seconds.

Usage:
scripts/generate-s3-post-url-data.py <bucket> <filename>

"""
import json
import boto3
from docopt import docopt


def generate_s3_post_data(bucket, filename):
    s3 = boto3.client('s3')

    fields = {"acl": "bucket-owner-read"}
    conditions = [
        {"acl": "bucket-owner-read"}
    ]

    post = s3.generate_presigned_post(
        Bucket=bucket,
        Key=filename,
        Fields=fields,
        Conditions=conditions,
        ExpiresIn=600
    )

    return json.dumps(post)

if __name__ == "__main__":
    arguments = docopt(__doc__)
    bucket = arguments['<bucket>']
    filename = arguments['<filename>']
    print(generate_s3_post_data(bucket, filename))

Apply bucket-owner-read acl to uploaded db dumps
Apply bucket-owner-read acl to uploaded db dumps

As per https://docs.aws.amazon.com/AmazonS3/latest/dev/crr-troubleshoot.html

> By default, the bucket owner does not have any permissions on the objects created by <another> account. And the replication configuration replicates only the objects for which the bucket owner has access permissions.

Therefore the bucket owner must be granted read permissions on the uploaded object for replicatino to work.
We do this by applying the `bucket-owner-read` canned acl detailed here:
https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl
