From f41014ede76ec9be1aa3a0dbb259195476f00f39 Mon Sep 17 00:00:00 2001
From: Zhengchao An <anzhengchao@gmail.com>
Date: Tue, 25 Aug 2026 04:34:02 +0800
Subject: [PATCH] test(e2e): require bucket policy denial code (#6557)

---
 crates/e2e_test/src/bucket_policy_check_test.rs | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/crates/e2e_test/src/bucket_policy_check_test.rs b/crates/e2e_test/src/bucket_policy_check_test.rs
index 0b9345f06..51800e195 100644
--- a/crates/e2e_test/src/bucket_policy_check_test.rs
+++ b/crates/e2e_test/src/bucket_policy_check_test.rs
@@ -17,6 +17,7 @@
 
 use crate::common::{RustFSTestEnvironment, init_logging};
 use aws_sdk_s3::config::{Credentials, Region};
+use aws_sdk_s3::error::ProvideErrorMetadata;
 use aws_sdk_s3::{Client, Config};
 use tracing::info;
 
@@ -73,10 +74,14 @@ async fn test_bucket_policy_authenticated_user() -> Result<(), Box<dyn std::erro
     let user_client = create_user_client(&env, user_access, user_secret);
 
     // 4. Verify Access Denied initially (No Policy)
-    let result = user_client.list_objects_v2().bucket(bucket_name).send().await;
-    if result.is_ok() {
-        return Err("Should be Access Denied initially".into());
-    }
+    let denied = user_client
+        .list_objects_v2()
+        .bucket(bucket_name)
+        .send()
+        .await
+        .expect_err("a user without a bucket policy must be denied");
+    assert_eq!(denied.raw_response().map(|response| response.status().as_u16()), Some(403));
+    assert_eq!(denied.as_service_error().and_then(ProvideErrorMetadata::code), Some("AccessDenied"));
 
     // 5. Apply Bucket Policy Allowed User
     let policy_json = serde_json::json!({