How do I write integration test that puts object into bucket and check if it exists

[kornicameister]

Hey,

I have this test:

integ.assertions
  .awsApiCall('@aws-sdk/client-s3', 'PutObjectCommand', {
    Body: Buffer.from(objectBody),
    Bucket: testStack.bucketName,
    Key: objectName,
  })
  .provider.addToRolePolicy({
    Effect: 'Allow',
    Action: ['kms:*'],
    Resource: ['*'],
  });

And generally it works as expected and I can find the object in the bucket, however the moment I try to extend the test with checking of objects exists I consistently receive 403 in lambda function.

const uploadFile = integ.assertions
  .awsApiCall('@aws-sdk/client-s3', 'PutObjectCommand', {
    Body: Buffer.from(objectBody),
    Bucket: testStack.bucketName,
    Key: objectName,
  })
  .waitForAssertions({
    totalTimeout: cdk.Duration.seconds(30),
  });
uploadFile.provider.addToRolePolicy({
  Effect: 'Allow',
  Action: ['kms:*'],
  Resource: ['*'],
});

const hasFile = integ.assertions
  .awsApiCall('@aws-sdk/client-s3', 'HeadObjectCommand', {
    Bucket: testStack.bucketName,
    Key: objectName,
  })
  .waitForAssertions({
    totalTimeout: cdk.Duration.minutes(5),
  });
hasFile.provider.addToRolePolicy({
  Effect: 'Allow',
  Action: ['kms:*', 's3:ListBucket'],
  Resource: ['*'],
});

uploadFile.next(hasFile);

I assume I am adding permissions in a wrong way but I actually tried couple of different ideas and failed everywhere.
Also, in this 2nd approach, event s3:PutObject now fails.

I must be putting permissions in a wrong place.... but where is the correct place.

Any idea?

Thx.