CAMEL-16809: camel-aws2-s3 - support ACL grant headers on putObject and multipart upload

[oscerd]

What

Adds support for explicit ACL grant headers on the aws2-s3 producer, complementing the existing canned-ACL support (CamelAwsS3CannedAcl / CamelAwsS3Acl).

Four new producer headers map to the S3 grant* request options on PutObject and CreateMultipartUpload:

Header	S3 request option
CamelAwsS3GrantFullControl	grantFullControl
CamelAwsS3GrantRead	grantRead
CamelAwsS3GrantReadACP	grantReadACP
CamelAwsS3GrantWriteACP	grantWriteACP

Each value is an S3 grantee expression (id=..., emailAddress=... or uri=...). This lets a route set explicit grantee-based ACLs when uploading objects — as requested in the issue (referencing aws/aws-sdk-java-v2#1703) — on both the single putObject and the multipart-upload paths.

Testing

• New AWS2S3ProducerAclGrantTest (Mockito + AssertJ): verifies all four grant headers are applied to the captured PutObjectRequest, and that the grant fields stay null when the headers are absent.
• Full-reactor mvn clean install -DskipTests passes; catalog and endpoint-DSL regenerated and committed.

Claude Code on behalf of oscerd

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[github-actions]

🧪 CI tested the following changed modules:

• catalog/camel-catalog
• components/camel-aws/camel-aws2-s3
• dsl/camel-endpointdsl

---

🔬 Scalpel shadow comparison — Scalpel: 12 tested, 27 compile-only — current: 10 all tested

Maveniverse Scalpel detected 39 affected modules (current approach: 10).

⚠️ Modules only in Scalpel (29)

• apache-camel
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-lucene
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-csimple-maven-plugin
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-test
• camel-kamelet-main
• camel-launcher
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• coverage
• docs
• dummy-component

Skip-tests mode would test 12 modules (3 direct + 9 downstream), skip tests for 27 (generated code, meta-modules)

Modules Scalpel would test (12)

• camel-aws2-eventbridge
• camel-aws2-s3
• camel-catalog
• camel-endpointdsl
• camel-jbang-mcp
• camel-jbang-plugin-mcp
• camel-jbang-plugin-route-parser
• camel-jbang-plugin-tui
• camel-jbang-plugin-validate
• camel-launcher-container
• camel-yaml-dsl-validator
• camel-yaml-dsl-validator-maven-plugin

Modules with tests skipped (27)

• apache-camel
• camel-allcomponents
• camel-catalog-console
• camel-catalog-lucene
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-csimple-maven-plugin
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-test
• camel-kamelet-main
• camel-launcher
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• coverage
• docs
• dummy-component

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

All tested modules (39 modules)

• Camel :: AWS2 Eventbridge
• Camel :: AWS2 S3
• Camel :: All Components Sync point
• Camel :: Assembly
• Camel :: Catalog :: CSimple Maven Plugin (deprecated)
• Camel :: Catalog :: Camel Catalog
• Camel :: Catalog :: Camel Report Maven Plugin
• Camel :: Catalog :: Camel Route Parser
• Camel :: Catalog :: Console
• Camel :: Catalog :: Dummy Component
• Camel :: Catalog :: Lucene (deprecated)
• Camel :: Catalog :: Maven
• Camel :: Catalog :: Suggest
• Camel :: Component DSL
• Camel :: Coverage
• Camel :: Docs
• Camel :: Endpoint DSL
• Camel :: Endpoint DSL :: Support
• Camel :: Integration Tests
• Camel :: JBang :: Core
• Camel :: JBang :: Integration tests
• Camel :: JBang :: MCP
• Camel :: JBang :: Main
• Camel :: JBang :: Plugin :: Edit
• Camel :: JBang :: Plugin :: Generate
• Camel :: JBang :: Plugin :: Kubernetes
• Camel :: JBang :: Plugin :: MCP
• Camel :: JBang :: Plugin :: Route Parser
• Camel :: JBang :: Plugin :: TUI
• Camel :: JBang :: Plugin :: Testing
• Camel :: JBang :: Plugin :: Validate
• Camel :: Kamelet Main
• Camel :: Launcher
• Camel :: Launcher :: Container
• Camel :: YAML DSL
• Camel :: YAML DSL :: Deserializers
• Camel :: YAML DSL :: Maven Plugins
• Camel :: YAML DSL :: Validator
• Camel :: YAML DSL :: Validator Maven Plugin

---

⚙️ View full build and test results

[atiaomar1978-hub]

Review (Bugbot + Grok + manual)

AI-generated review.

Verdict: Looks good to merge with minor follow-ups. CI is green; implementation matches existing CamelAwsS3CannedAcl patterns.

Bugbot

No bugs found in grant header wiring for PutObject and CreateMultipartUpload.

Security

No medium-or-higher findings. Grant headers use the Camel* namespace and follow the same trust model as CamelAwsS3CannedAcl: route authors are trusted, AWS IAM + bucket policy enforce authorization. Routes bridging untrusted senders should still use removeHeaders("Camel*") at the trust boundary.

Test coverage gaps

1. Multipart CreateMultipartUpload not tested — AWS2S3ProducerAclGrantTest only captures PutObjectRequest. The PR description mentions multipart, but there is no test that forces a payload ≥ partSize and asserts grants on CreateMultipartUploadRequest.
2. AWS2S3StreamUploadProducer not updated — streaming upload supports CANNED_ACL but not the new grant headers. Functional inconsistency; consider a follow-up or a note in the PR.

Documentation

aws2-s3-producer-operations.adoc documents CamelAwsS3CannedAcl but not the four new grant headers. Worth adding examples there.

Minor (non-blocking)

• Grant header block is duplicated in doPutObject() and processMultiPart() — a small helper would reduce drift risk.
• A one-line comment on grant + acl() coexistence (AWS semantics) would help future readers.

Nice work on closing the AWS SDK grant-header gap for put/multipart upload paths.

[gnodet]

Clean feature addition of four ACL grant headers to the AWS2 S3 producer. The implementation correctly follows existing patterns (header read, null check, set on builder) and the test follows the established Mockito approach in this module.

One observation:

The test (AWS2S3ProducerAclGrantTest) only covers the doPutObject code path (small String body, isMultiPartUpload() defaults to false). However, the processMultiPart method is also modified with the same four grant-header blocks but has no test coverage. Since the PR title explicitly claims multipart upload support, adding a test that exercises the multipart path (with isMultiPartUpload() set to true, capturing CreateMultipartUploadRequest) would ensure both modified paths are verified and guard against future divergence.

Otherwise the implementation looks good — header documentation is automatically handled via @Metadata annotations, and the code changes are clean and consistent.

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of @gnodet