{
  "schemaVersion": "1.0.0",
  "policyKind": "iam_identity",
  "permissionTests": [
    {
      "label": "Reporting reads inputs",
      "action": "s3:GetObject",
      "resource": "arn:aws:s3:::cotton-synthetic-reporting/inputs/source.csv",
      "expectedBehavior": "allow"
    },
    {
      "label": "Reporting writes reports",
      "action": "s3:PutObject",
      "resource": "arn:aws:s3:::cotton-synthetic-reporting/reports/daily.csv",
      "expectedBehavior": "allow"
    },
    {
      "label": "Reporting reads reports",
      "action": "s3:GetObject",
      "resource": "arn:aws:s3:::cotton-synthetic-reporting/reports/daily.csv",
      "expectedBehavior": "allow"
    },
    {
      "label": "Exporter writes exports",
      "action": "s3:PutObject",
      "resource": "arn:aws:s3:::cotton-synthetic-reporting/exports/delivery.csv",
      "expectedBehavior": "allow"
    },
    {
      "label": "Unrelated reads stay denied",
      "action": "s3:GetObject",
      "resource": "arn:aws:s3:::cotton-synthetic-reporting/unrelated/private.csv",
      "expectedBehavior": "deny"
    },
    {
      "label": "Object deletion stays denied",
      "action": "s3:DeleteObject",
      "resource": "arn:aws:s3:::cotton-synthetic-reporting/reports/daily.csv",
      "expectedBehavior": "deny"
    }
  ]
}