squash! sts: test get_object() before put_object() so there are no ACLs

Author: cbodley

s3tests/functional/test_sts.py

@@ -1135,15 +1135,15 @@ def test_session_policy_bucket_policy_session_arn():
         "Statement": [{
         "Effect": "Allow",
         "Principal": {"AWS": "{}".format(rolesessionarn)},
-        "Action": ["s3:GetObject","s3:PutObject"],
+        "Action": ["s3:GetObject","s3:PutObject","s3:ListBucket"],
         "Resource": [
             "{}".format(resource1),
             "{}".format(resource2)
           ]
         }]
     })
     s3client_iamcreds.put_bucket_policy(Bucket=bucket_name_1, Policy=bucket_policy)
-    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
+    session_policy = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":[\"s3:PutObject\",\"s3:ListBucket\"],\"Resource\":[\"arn:aws:s3:::test1\",\"arn:aws:s3:::test1/*\"]}}"
 
     resp=sts_client.assume_role_with_web_identity(RoleArn=role_response['Role']['Arn'],RoleSessionName=role_session_name,WebIdentityToken=token,Policy=session_policy)
     assert resp['ResponseMetadata']['HTTPStatusCode'] == 200