Fixed several issues with group cmdlets

ffeldhaus · ffeldhaus · commit 7a9c13bba675 · 2019-01-15T17:27:54.000+01:00
diff --git a/src/StorageGRID-Webscale.psm1 b/src/StorageGRID-Webscale.psm1
@@ -10523,7 +10523,10 @@ function Global:Get-SgwGroups {
             Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
         }
 
-        Write-Output $Response.Json.data
+        $Groups = $Response.Json.data
+        $Groups | Foreach-Object { $_.policies = $_.policies | ConvertTo-Json -Depth 10 }
+
+        Write-Output $Groups
     }
 }
 
@@ -10751,17 +10754,19 @@ function Global:New-SgwGroup {
             $Body.policies.management.rootAccess = $RootAccess.IsPresent
         }
         if ($Account.Capabilities -match "s3") {
-            if (!$IamPolicy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {
+            # make sure that S3 Policy does not include a Principal
+            $S3Policy = $S3Policy -replace '\s*"Principal":\s*"[^"]*"\s*,?','' -replace ',}','}'
+            if (!$S3Policy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {
                 Write-Warning "S3 capability specified, but no S3 Group Policy provided. Users of this group will not be able to execute any S3 commands on buckets or objects."
             }
             elseif ($S3FullAccess.IsPresent) {
                 $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":"s3:*"}]}'
             }
             elseif ($S3ReadOnlyAccess.IsPresent) {
-                $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":"s3:ListBucket s3:ListBucketVersions s3:ListAllMyBuckets s3:ListBucketMultipartUploads s3:ListMultipartUploadParts s3:GetAccelerateConfiguration s3:GetAnalyticsConfiguration s3:GetBucketAcl s3:GetBucketCORS s3:GetBucketLocation s3:GetBucketLogging s3:GetBucketNotification s3:GetBucketPolicy s3:GetBucketRequestPayment s3:GetBucketTagging s3:GetBucketVersioning s3:GetBucketWebsite s3:GetInventoryConfiguration s3:GetIpConfiguration s3:GetLifecycleConfiguration s3:GetMetricsConfiguration s3:GetObject s3:GetObjectAcl s3:GetObjectTagging s3:GetObjectTorrent s3:GetObjectVersion s3:GetObjectVersionAcl s3:GetObjectVersionForReplication s3:GetObjectVersionTagging s3:GetObjectVersionTorrent s3:GetReplicationConfiguration"}]}'
+                $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":["s3:ListBucket","s3:ListBucketVersions","s3:ListAllMyBuckets","s3:ListBucketMultipartUploads","s3:ListMultipartUploadParts","s3:GetBucketCORS","s3:GetBucketLocation","s3:GetBucketNotification","s3:GetBucketPolicy","s3:GetBucketVersioning","s3:GetObject","s3:GetObjectTagging","s3:GetObjectVersion","s3:GetObjectVersionTagging","s3:GetReplicationConfiguration"]}]}'
             }
             else {
-                $Body.policies.s3 = $IamPolicy
+                $Body.policies.s3 = $S3Policy
             }
         }
 
@@ -10785,7 +10790,10 @@ function Global:New-SgwGroup {
             Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
         }
 
-        Write-Output $Response.Json.data
+        $Group = $Response.Json.data
+        $Group.policies = $Group.policies | ConvertTo-Json -Depth 10
+
+        Write-Output $Group
     }
 }
 
@@ -10856,7 +10864,10 @@ function Global:Get-SgwGroupByShortName {
             Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
         }
 
-        Write-Output $Response.Json.data
+        $Group = $Response.Json.data
+        $Group.policies = $Group.policies | ConvertTo-Json -Depth 10
+
+        Write-Output $Group
     }
 }
 
@@ -10927,10 +10938,14 @@ function Global:Get-SgwFederatedGroupByShortName {
             Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
         }
 
-        Write-Output $Response.Json.data
+        $Group = $Response.Json.data
+        $Group.policies = $Group.policies | ConvertTo-Json -Depth 10
+
+        Write-Output $Group
     }
 }
 
+New-Alias -Name Delete-SgwGroup -Value Remove-SgwGroup
 <#
     .SYNOPSIS
     Deletes a single Group
@@ -10943,7 +10958,7 @@ function Global:Get-SgwFederatedGroupByShortName {
     .PARAMETER Id
     ID of a StorageGRID Webscale Group to delete.
 #>
-function Global:Delete-SgwGroup {
+function Global:Remove-SgwGroup {
     [CmdletBinding()]
 
     PARAM (
@@ -11073,7 +11088,10 @@ function Global:Get-SgwGroup {
             Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
         }
 
-        Write-Output $Response.Json.data
+        $Group = $Response.Json.data
+        $Group.policies = $Group.policies | ConvertTo-Json -Depth 10
+
+        Write-Output $Group
     }
 }
 
@@ -11140,6 +11158,7 @@ function Global:Update-SgwGroup {
         [parameter(
                 Mandatory = $False,
                 Position = 3,
+                ValueFromPipelineByPropertyName = $true,
                 HelpMessage = "The human-readable name for the Group (required for local Groups and imported automatically for federated Groups).")][String]$DisplayName,
         [parameter(
                 Mandatory = $False,
@@ -11196,6 +11215,7 @@ function Global:Update-SgwGroup {
         [parameter(
                 Mandatory = $False,
                 Position = 17,
+                ValueFromPipelineByPropertyName = $true,
                 HelpMessage = "S3 Group Policy.")][PSCustomObject]$S3Policy,
         [parameter(
                 Mandatory = $False,
@@ -11284,17 +11304,19 @@ function Global:Update-SgwGroup {
             $Body.policies.management.rootAccess = $RootAccess.IsPresent
         }
         if ($Account.Capabilities -match "s3") {
-            if (!$IamPolicy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {
+            # make sure that S3 Policy does not include a Principal
+            $S3Policy = $S3Policy -replace '\s*"Principal":\s*"[^"]*"\s*,?','' -replace ',}','}'
+            if (!$S3Policy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {
                 Write-Warning "S3 capability specified, but no S3 Group Policy provided. Users of this group will not be able to execute any S3 commands on buckets or objects."
             }
             elseif ($S3FullAccess.IsPresent) {
                 $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":"s3:*"}]}'
             }
             elseif ($S3ReadOnlyAccess.IsPresent) {
-                $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":"s3:ListBucket s3:ListBucketVersions s3:ListAllMyBuckets s3:ListBucketMultipartUploads s3:ListMultipartUploadParts s3:GetAccelerateConfiguration s3:GetAnalyticsConfiguration s3:GetBucketAcl s3:GetBucketCORS s3:GetBucketLocation s3:GetBucketLogging s3:GetBucketNotification s3:GetBucketPolicy s3:GetBucketRequestPayment s3:GetBucketTagging s3:GetBucketVersioning s3:GetBucketWebsite s3:GetInventoryConfiguration s3:GetIpConfiguration s3:GetLifecycleConfiguration s3:GetMetricsConfiguration s3:GetObject s3:GetObjectAcl s3:GetObjectTagging s3:GetObjectTorrent s3:GetObjectVersion s3:GetObjectVersionAcl s3:GetObjectVersionForReplication s3:GetObjectVersionTagging s3:GetObjectVersionTorrent s3:GetReplicationConfiguration"}]}'
+                $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":["s3:ListBucket","s3:ListBucketVersions","s3:ListAllMyBuckets","s3:ListBucketMultipartUploads","s3:ListMultipartUploadParts","s3:GetBucketCORS","s3:GetBucketLocation","s3:GetBucketNotification","s3:GetBucketPolicy","s3:GetBucketVersioning","s3:GetObject","s3:GetObjectTagging","s3:GetObjectVersion","s3:GetObjectVersionTagging","s3:GetReplicationConfiguration"]}]}'
             }
             else {
-                $Body.policies.s3 = $IamPolicy
+                $Body.policies.s3 = $S3Policy
             }
         }
 
@@ -11318,7 +11340,10 @@ function Global:Update-SgwGroup {
             Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
         }
 
-        Write-Output $Response.Json.data
+        $Group = $Response.Json.data
+        $Group.policies = $Group.policies | ConvertTo-Json -Depth 10
+
+        Write-Output $Group
     }
 }
 
@@ -11393,6 +11418,7 @@ function Global:Replace-SgwGroup {
         [parameter(
                 Mandatory = $False,
                 Position = 3,
+                ValueFromPipelineByPropertyName = $true,
                 HelpMessage = "The human-readable name for the Group (required for local Groups and imported automatically for federated Groups).")][String]$DisplayName,
         [parameter(
                 Mandatory = $False,
@@ -11457,6 +11483,7 @@ function Global:Replace-SgwGroup {
         [parameter(
                 Mandatory = $False,
                 Position = 19,
+                ValueFromPipelineByPropertyName = $true,
                 HelpMessage = "S3 Group Policy.")][PSCustomObject]$S3Policy,
         [parameter(
                 Mandatory = $False,
@@ -11557,17 +11584,19 @@ function Global:Replace-SgwGroup {
             $Body.policies.management.rootAccess = $RootAccess.IsPresent
         }
         if ($Account.Capabilities -match "s3") {
-            if (!$IamPolicy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {
+            # make sure that S3 Policy does not include a Principal
+            $S3Policy = $S3Policy -replace '\s*"Principal":\s*"[^"]*"\s*,?','' -replace ',}','}'
+            if (!$S3Policy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {
                 Write-Warning "S3 capability specified, but no S3 Group Policy provided. Users of this group will not be able to execute any S3 commands on buckets or objects."
             }
             elseif ($S3FullAccess.IsPresent) {
                 $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":"s3:*"}]}'
             }
             elseif ($S3ReadOnlyAccess.IsPresent) {
-                $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":"s3:ListBucket s3:ListBucketVersions s3:ListAllMyBuckets s3:ListBucketMultipartUploads s3:ListMultipartUploadParts s3:GetAccelerateConfiguration s3:GetAnalyticsConfiguration s3:GetBucketAcl s3:GetBucketCORS s3:GetBucketLocation s3:GetBucketLogging s3:GetBucketNotification s3:GetBucketPolicy s3:GetBucketRequestPayment s3:GetBucketTagging s3:GetBucketVersioning s3:GetBucketWebsite s3:GetInventoryConfiguration s3:GetIpConfiguration s3:GetLifecycleConfiguration s3:GetMetricsConfiguration s3:GetObject s3:GetObjectAcl s3:GetObjectTagging s3:GetObjectTorrent s3:GetObjectVersion s3:GetObjectVersionAcl s3:GetObjectVersionForReplication s3:GetObjectVersionTagging s3:GetObjectVersionTorrent s3:GetReplicationConfiguration"}]}'
+                $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":["s3:ListBucket","s3:ListBucketVersions","s3:ListAllMyBuckets","s3:ListBucketMultipartUploads","s3:ListMultipartUploadParts","s3:GetBucketCORS","s3:GetBucketLocation","s3:GetBucketNotification","s3:GetBucketPolicy","s3:GetBucketVersioning","s3:GetObject","s3:GetObjectTagging","s3:GetObjectVersion","s3:GetObjectVersionTagging","s3:GetReplicationConfiguration"]}]}'
             }
             else {
-                $Body.policies.s3 = $IamPolicy
+                $Body.policies.s3 = $S3Policy
             }
         }
 
@@ -11591,7 +11620,10 @@ function Global:Replace-SgwGroup {
             Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
         }
 
-        Write-Output $Response.Json.data
+        $Group = $Response.Json.data
+        $Group.policies = $Group.policies | ConvertTo-Json -Depth 10
+
+        Write-Output $Group
     }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -10523,7 +10523,10 @@ function Global:Get-SgwGroups {`
`10523`	`10523`	Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
`10524`	`10524`	`}`
`10525`	`10525`
`10526`		`- Write-Output $Response.Json.data`
	`10526`	`+ $Groups = $Response.Json.data`
	`10527`	`+ $Groups \| Foreach-Object { $_.policies = $_.policies \| ConvertTo-Json -Depth 10 }`
	`10528`	`+`
	`10529`	`+ Write-Output $Groups`
`10527`	`10530`	`}`
`10528`	`10531`	`}`
`10529`	`10532`
`@@ -10751,17 +10754,19 @@ function Global:New-SgwGroup {`
`10751`	`10754`	`$Body.policies.management.rootAccess = $RootAccess.IsPresent`
`10752`	`10755`	`}`
`10753`	`10756`	`if ($Account.Capabilities -match "s3") {`
`10754`		`- if (!$IamPolicy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {`
	`10757`	`+ # make sure that S3 Policy does not include a Principal`
	`10758`	`+ $S3Policy = $S3Policy -replace '\s"Principal":\s"[^"]"\s,?','' -replace ',}','}'`
	`10759`	`+ if (!$S3Policy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {`
`10755`	`10760`	`Write-Warning "S3 capability specified, but no S3 Group Policy provided. Users of this group will not be able to execute any S3 commands on buckets or objects."`
`10756`	`10761`	`}`
`10757`	`10762`	`elseif ($S3FullAccess.IsPresent) {`
`10758`	`10763`	`$Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::","Action":"s3:"}]}'`
`10759`	`10764`	`}`
`10760`	`10765`	`elseif ($S3ReadOnlyAccess.IsPresent) {`
`10761`		- $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":"s3:ListBucket s3:ListBucketVersions s3:ListAllMyBuckets s3:ListBucketMultipartUploads s3:ListMultipartUploadParts s3:GetAccelerateConfiguration s3:GetAnalyticsConfiguration s3:GetBucketAcl s3:GetBucketCORS s3:GetBucketLocation s3:GetBucketLogging s3:GetBucketNotification s3:GetBucketPolicy s3:GetBucketRequestPayment s3:GetBucketTagging s3:GetBucketVersioning s3:GetBucketWebsite s3:GetInventoryConfiguration s3:GetIpConfiguration s3:GetLifecycleConfiguration s3:GetMetricsConfiguration s3:GetObject s3:GetObjectAcl s3:GetObjectTagging s3:GetObjectTorrent s3:GetObjectVersion s3:GetObjectVersionAcl s3:GetObjectVersionForReplication s3:GetObjectVersionTagging s3:GetObjectVersionTorrent s3:GetReplicationConfiguration"}]}'
	`10766`	`+ $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":["s3:ListBucket","s3:ListBucketVersions","s3:ListAllMyBuckets","s3:ListBucketMultipartUploads","s3:ListMultipartUploadParts","s3:GetBucketCORS","s3:GetBucketLocation","s3:GetBucketNotification","s3:GetBucketPolicy","s3:GetBucketVersioning","s3:GetObject","s3:GetObjectTagging","s3:GetObjectVersion","s3:GetObjectVersionTagging","s3:GetReplicationConfiguration"]}]}'`
`10762`	`10767`	`}`
`10763`	`10768`	`else {`
`10764`		`- $Body.policies.s3 = $IamPolicy`
	`10769`	`+ $Body.policies.s3 = $S3Policy`
`10765`	`10770`	`}`
`10766`	`10771`	`}`
`10767`	`10772`
`@@ -10785,7 +10790,10 @@ function Global:New-SgwGroup {`
`10785`	`10790`	Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
`10786`	`10791`	`}`
`10787`	`10792`
`10788`		`- Write-Output $Response.Json.data`
	`10793`	`+ $Group = $Response.Json.data`
	`10794`	`+ $Group.policies = $Group.policies \| ConvertTo-Json -Depth 10`
	`10795`	`+`
	`10796`	`+ Write-Output $Group`
`10789`	`10797`	`}`
`10790`	`10798`	`}`
`10791`	`10799`
`@@ -10856,7 +10864,10 @@ function Global:Get-SgwGroupByShortName {`
`10856`	`10864`	Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
`10857`	`10865`	`}`
`10858`	`10866`
`10859`		`- Write-Output $Response.Json.data`
	`10867`	`+ $Group = $Response.Json.data`
	`10868`	`+ $Group.policies = $Group.policies \| ConvertTo-Json -Depth 10`
	`10869`	`+`
	`10870`	`+ Write-Output $Group`
`10860`	`10871`	`}`
`10861`	`10872`	`}`
`10862`	`10873`
`@@ -10927,10 +10938,14 @@ function Global:Get-SgwFederatedGroupByShortName {`
`10927`	`10938`	Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
`10928`	`10939`	`}`
`10929`	`10940`
`10930`		`- Write-Output $Response.Json.data`
	`10941`	`+ $Group = $Response.Json.data`
	`10942`	`+ $Group.policies = $Group.policies \| ConvertTo-Json -Depth 10`
	`10943`	`+`
	`10944`	`+ Write-Output $Group`
`10931`	`10945`	`}`
`10932`	`10946`	`}`
`10933`	`10947`
	`10948`	`+New-Alias -Name Delete-SgwGroup -Value Remove-SgwGroup`
`10934`	`10949`	`<#`
`10935`	`10950`	`.SYNOPSIS`
`10936`	`10951`	`Deletes a single Group`
`@@ -10943,7 +10958,7 @@ function Global:Get-SgwFederatedGroupByShortName {`
`10943`	`10958`	`.PARAMETER Id`
`10944`	`10959`	`ID of a StorageGRID Webscale Group to delete.`
`10945`	`10960`	`#>`
`10946`		`-function Global:Delete-SgwGroup {`
	`10961`	`+function Global:Remove-SgwGroup {`
`10947`	`10962`	`[CmdletBinding()]`
`10948`	`10963`
`10949`	`10964`	`PARAM (`
`@@ -11073,7 +11088,10 @@ function Global:Get-SgwGroup {`
`11073`	`11088`	Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
`11074`	`11089`	`}`
`11075`	`11090`
`11076`		`- Write-Output $Response.Json.data`
	`11091`	`+ $Group = $Response.Json.data`
	`11092`	`+ $Group.policies = $Group.policies \| ConvertTo-Json -Depth 10`
	`11093`	`+`
	`11094`	`+ Write-Output $Group`
`11077`	`11095`	`}`
`11078`	`11096`	`}`
`11079`	`11097`
`@@ -11140,6 +11158,7 @@ function Global:Update-SgwGroup {`
`11140`	`11158`	`[parameter(`
`11141`	`11159`	`Mandatory = $False,`
`11142`	`11160`	`Position = 3,`
	`11161`	`+ ValueFromPipelineByPropertyName = $true,`
`11143`	`11162`	`HelpMessage = "The human-readable name for the Group (required for local Groups and imported automatically for federated Groups).")][String]$DisplayName,`
`11144`	`11163`	`[parameter(`
`11145`	`11164`	`Mandatory = $False,`
`@@ -11196,6 +11215,7 @@ function Global:Update-SgwGroup {`
`11196`	`11215`	`[parameter(`
`11197`	`11216`	`Mandatory = $False,`
`11198`	`11217`	`Position = 17,`
	`11218`	`+ ValueFromPipelineByPropertyName = $true,`
`11199`	`11219`	`HelpMessage = "S3 Group Policy.")][PSCustomObject]$S3Policy,`
`11200`	`11220`	`[parameter(`
`11201`	`11221`	`Mandatory = $False,`
`@@ -11284,17 +11304,19 @@ function Global:Update-SgwGroup {`
`11284`	`11304`	`$Body.policies.management.rootAccess = $RootAccess.IsPresent`
`11285`	`11305`	`}`
`11286`	`11306`	`if ($Account.Capabilities -match "s3") {`
`11287`		`- if (!$IamPolicy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {`
	`11307`	`+ # make sure that S3 Policy does not include a Principal`
	`11308`	`+ $S3Policy = $S3Policy -replace '\s"Principal":\s"[^"]"\s,?','' -replace ',}','}'`
	`11309`	`+ if (!$S3Policy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {`
`11288`	`11310`	`Write-Warning "S3 capability specified, but no S3 Group Policy provided. Users of this group will not be able to execute any S3 commands on buckets or objects."`
`11289`	`11311`	`}`
`11290`	`11312`	`elseif ($S3FullAccess.IsPresent) {`
`11291`	`11313`	`$Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::","Action":"s3:"}]}'`
`11292`	`11314`	`}`
`11293`	`11315`	`elseif ($S3ReadOnlyAccess.IsPresent) {`
`11294`		- $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":"s3:ListBucket s3:ListBucketVersions s3:ListAllMyBuckets s3:ListBucketMultipartUploads s3:ListMultipartUploadParts s3:GetAccelerateConfiguration s3:GetAnalyticsConfiguration s3:GetBucketAcl s3:GetBucketCORS s3:GetBucketLocation s3:GetBucketLogging s3:GetBucketNotification s3:GetBucketPolicy s3:GetBucketRequestPayment s3:GetBucketTagging s3:GetBucketVersioning s3:GetBucketWebsite s3:GetInventoryConfiguration s3:GetIpConfiguration s3:GetLifecycleConfiguration s3:GetMetricsConfiguration s3:GetObject s3:GetObjectAcl s3:GetObjectTagging s3:GetObjectTorrent s3:GetObjectVersion s3:GetObjectVersionAcl s3:GetObjectVersionForReplication s3:GetObjectVersionTagging s3:GetObjectVersionTorrent s3:GetReplicationConfiguration"}]}'
	`11316`	`+ $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":["s3:ListBucket","s3:ListBucketVersions","s3:ListAllMyBuckets","s3:ListBucketMultipartUploads","s3:ListMultipartUploadParts","s3:GetBucketCORS","s3:GetBucketLocation","s3:GetBucketNotification","s3:GetBucketPolicy","s3:GetBucketVersioning","s3:GetObject","s3:GetObjectTagging","s3:GetObjectVersion","s3:GetObjectVersionTagging","s3:GetReplicationConfiguration"]}]}'`
`11295`	`11317`	`}`
`11296`	`11318`	`else {`
`11297`		`- $Body.policies.s3 = $IamPolicy`
	`11319`	`+ $Body.policies.s3 = $S3Policy`
`11298`	`11320`	`}`
`11299`	`11321`	`}`
`11300`	`11322`
`@@ -11318,7 +11340,10 @@ function Global:Update-SgwGroup {`
`11318`	`11340`	Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
`11319`	`11341`	`}`
`11320`	`11342`
`11321`		`- Write-Output $Response.Json.data`
	`11343`	`+ $Group = $Response.Json.data`
	`11344`	`+ $Group.policies = $Group.policies \| ConvertTo-Json -Depth 10`
	`11345`	`+`
	`11346`	`+ Write-Output $Group`
`11322`	`11347`	`}`
`11323`	`11348`	`}`
`11324`	`11349`
`@@ -11393,6 +11418,7 @@ function Global:Replace-SgwGroup {`
`11393`	`11418`	`[parameter(`
`11394`	`11419`	`Mandatory = $False,`
`11395`	`11420`	`Position = 3,`
	`11421`	`+ ValueFromPipelineByPropertyName = $true,`
`11396`	`11422`	`HelpMessage = "The human-readable name for the Group (required for local Groups and imported automatically for federated Groups).")][String]$DisplayName,`
`11397`	`11423`	`[parameter(`
`11398`	`11424`	`Mandatory = $False,`
`@@ -11457,6 +11483,7 @@ function Global:Replace-SgwGroup {`
`11457`	`11483`	`[parameter(`
`11458`	`11484`	`Mandatory = $False,`
`11459`	`11485`	`Position = 19,`
	`11486`	`+ ValueFromPipelineByPropertyName = $true,`
`11460`	`11487`	`HelpMessage = "S3 Group Policy.")][PSCustomObject]$S3Policy,`
`11461`	`11488`	`[parameter(`
`11462`	`11489`	`Mandatory = $False,`
`@@ -11557,17 +11584,19 @@ function Global:Replace-SgwGroup {`
`11557`	`11584`	`$Body.policies.management.rootAccess = $RootAccess.IsPresent`
`11558`	`11585`	`}`
`11559`	`11586`	`if ($Account.Capabilities -match "s3") {`
`11560`		`- if (!$IamPolicy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {`
	`11587`	`+ # make sure that S3 Policy does not include a Principal`
	`11588`	`+ $S3Policy = $S3Policy -replace '\s"Principal":\s"[^"]"\s,?','' -replace ',}','}'`
	`11589`	`+ if (!$S3Policy -and !($S3FullAccess.IsPresent -or $S3ReadOnlyAccess)) {`
`11561`	`11590`	`Write-Warning "S3 capability specified, but no S3 Group Policy provided. Users of this group will not be able to execute any S3 commands on buckets or objects."`
`11562`	`11591`	`}`
`11563`	`11592`	`elseif ($S3FullAccess.IsPresent) {`
`11564`	`11593`	`$Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::","Action":"s3:"}]}'`
`11565`	`11594`	`}`
`11566`	`11595`	`elseif ($S3ReadOnlyAccess.IsPresent) {`
`11567`		- $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":"s3:ListBucket s3:ListBucketVersions s3:ListAllMyBuckets s3:ListBucketMultipartUploads s3:ListMultipartUploadParts s3:GetAccelerateConfiguration s3:GetAnalyticsConfiguration s3:GetBucketAcl s3:GetBucketCORS s3:GetBucketLocation s3:GetBucketLogging s3:GetBucketNotification s3:GetBucketPolicy s3:GetBucketRequestPayment s3:GetBucketTagging s3:GetBucketVersioning s3:GetBucketWebsite s3:GetInventoryConfiguration s3:GetIpConfiguration s3:GetLifecycleConfiguration s3:GetMetricsConfiguration s3:GetObject s3:GetObjectAcl s3:GetObjectTagging s3:GetObjectTorrent s3:GetObjectVersion s3:GetObjectVersionAcl s3:GetObjectVersionForReplication s3:GetObjectVersionTagging s3:GetObjectVersionTorrent s3:GetReplicationConfiguration"}]}'
	`11596`	`+ $Body.policies.s3 = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Resource":"urn:sgws:s3:::*","Action":["s3:ListBucket","s3:ListBucketVersions","s3:ListAllMyBuckets","s3:ListBucketMultipartUploads","s3:ListMultipartUploadParts","s3:GetBucketCORS","s3:GetBucketLocation","s3:GetBucketNotification","s3:GetBucketPolicy","s3:GetBucketVersioning","s3:GetObject","s3:GetObjectTagging","s3:GetObjectVersion","s3:GetObjectVersionTagging","s3:GetReplicationConfiguration"]}]}'`
`11568`	`11597`	`}`
`11569`	`11598`	`else {`
`11570`		`- $Body.policies.s3 = $IamPolicy`
	`11599`	`+ $Body.policies.s3 = $S3Policy`
`11571`	`11600`	`}`
`11572`	`11601`	`}`
`11573`	`11602`
`@@ -11591,7 +11620,10 @@ function Global:Replace-SgwGroup {`
`11591`	`11620`	Throw "$Method to $Uri failed with Exception $( $_.Exception.Message ) `n $responseBody"
`11592`	`11621`	`}`
`11593`	`11622`
`11594`		`- Write-Output $Response.Json.data`
	`11623`	`+ $Group = $Response.Json.data`
	`11624`	`+ $Group.policies = $Group.policies \| ConvertTo-Json -Depth 10`
	`11625`	`+`
	`11626`	`+ Write-Output $Group`
`11595`	`11627`	`}`
`11596`	`11628`	`}`
`11597`	`11629`