How can I check if AWS S3 sync has any changes?

Question

I have some files in an Amazon S3 bucket, and I'm using SaltStack to copy all of those files to a directory on a minion.

Unfortunately, SaltStack doesn't have the abilty to copy an entire directory from S3 (yet), so I've resorted to using the awscli. It works almost perfectly.

It can sync the S3 bucket and my directory (hooray!), and it even has a --dryrun flag (even better!), but unfortunately I cannot figure out a way to make it do something that I can capture with Salt to say that there are no changes.

I have a Salt state that looks like this:

copy-my-dir:
  file.directory:
    - name: /path/to/my/dir
    - makedirs: True
  cmd.run:
    - name: "aws s3 sync s3://my-bucket/ /path/to/my/dir"
    - unless: "What goes here?"

I've tried --dry-run for "what goes here?" but aws s3 sync returns 0 whether there are files to sync or not.

I tried aws --output json s3 sync --dry-run but that doesn't even come close to doing anything useful (i.e. it doesn't output JSON that I can tell, at least not when running via salt 'minion' cmd.run "aws...".

So how can I tell if there are any differences between my Amazon S3 bucket and my directory so I can conditionally execute a SaltStack state?

Answer 1

Turns out that the wonderful grep utility can do exactly what I need:

- onlyif: "aws s3 sync --dryrun s3://my-bucket /path/to/my/dir" | grep download"

If there's something to do, awscli will output download: <filename>, but if the directories are synced up then there is no output.