Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

S3: don't require attempt to create bucket in s3.NewClient #115

Open
bartleyg opened this issue Oct 21, 2022 · 0 comments
Open

S3: don't require attempt to create bucket in s3.NewClient #115

bartleyg opened this issue Oct 21, 2022 · 0 comments

Comments

@bartleyg
Copy link

A service will fail with s3.NewClient() at https://github.com/philippgille/gokv/blob/master/s3/s3.go#L228-L231 when a service does not have permission to create an S3 bucket resulting in error:

AccessDenied: Access Denied
	status code: 403, request id: EPNQB6MRQ3KGSD2P, host id: nUu8pPdr5eWKjAn6PLg2fuNxyZnflz+UcwnnfUn3584LfcMTqCCQcV95Nw+Nb7k1B8l9hxmkrEo=

In this use case, the bucket has already been created elsewhere, so the service has limited s3.GetObject, s3.PutObject, s3.DeleteObject type permissions.

A non-breaking fix could be an option like #101 provides to skip the create bucket attempt. While I recognize the create bucket attempt is there to ease usability, testing, and compatibility with non-S3 services, it does run counter to least-privilege and least-surprise patterns.

Another non-breaking fix could be to change the logic in s3.NewClient() for origS3 to see if the bucket already exists before creating with ListBuckets, but that can also result in a 403 for this use case. You could also just handle the 403 errors from CreateBucket, ListBuckets, etc by not failing and attempting to proceed with the client.

A breaking fix I would propose would be to default to no unnecessary S3 calls in s3.NewClient() and to explicitly pass the option in if you wanted to try creating, listing, validating the bucket first.

Thank you for this very cool module I stumbled upon :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant