Почему minio.error.S3Error: S3 operation failed; code: AccessDenied?

Question

[Николай Бараненко]

Создаю бакет

mc mb local/musor-bucket --debug

Создаю пару секретную пару
access_key="musor-user"
secret_key="musor-top-secret-key"

mc admin user add local musor-user musor-top-secret-key --debug

Создаю файл с политикой и саму политику

# cat musor-bucket-policy.json
{
  "Version": "2012-10-17",
  "Statement": [
   {
    "Sid": "AllowBucketSync",
    "Effect": "Allow",
    "Action": [
     "s3:GetObject",
     "s3:ListBucket",
     "s3:PutObject"
    ],
    "Resource": [
     "arn:aws:s3:::musor-bucket",
     "arn:aws:s3:::musor-bucket/*"
    ]
   }
  ]
 }

добавляю политику

mc admin policy create local musor-bucket-policy ./data/musor-bucket-policy.json --debug

навешиваю политику на пользователя

mc admin policy attach local musor-bucket-policy --user=musor-user --debug

проверяю пользователя

# mc admin user info local musor-user
AccessKey: musor-user
Status: enabled
PolicyName: musor-bucket-policy
MemberOf: []

проверяю политику

# mc admin policy info local musor-bucket-policy --policy-file ./data/musor-bucket-policy.json
{
 "PolicyName": "musor-bucket-policy",
 "Policy": {
  "Version": "2012-10-17",
  "Statement": [
   {
    "Sid": "AllowBucketSync",
    "Effect": "Allow",
    "Action": [
     "s3:GetObject",
     "s3:ListBucket",
     "s3:PutObject"
    ],
    "Resource": [
     "arn:aws:s3:::musor-bucket",
     "arn:aws:s3:::musor-bucket/*"
    ]
   }
  ]
 },
 "CreateDate": "2024-12-08T01:15:21.171Z",
 "UpdateDate": "2024-12-08T01:15:21.171Z"
}

Пробую подключиться через клиента на python

from minio import Minio
from minio.commonconfig import SnowballObject
from urllib3 import PoolManager


access_key="musor-user"
secret_key="musor-top-secret-key"


pool_manager = PoolManager(
    ca_certs="minio/tls-ca-bundle.pem",
    cert_reqs="CERT_REQUIRED",
)

client = Minio(
    "minio.local:443",
    access_key=access_key,
    secret_key=secret_key,
    secure=True,
    http_client=pool_manager
)

print(client.bucket_exists("musor-bucket"));

возвращается ошибка

minio.error.S3Error: S3 operation failed; code: AccessDenied, message: Access Denied., resource: /musor-bucket, request_id: 180F0EC003737710, host_id: 03f6d7ba09b0531a178059659f12e65ab6a75adddf2f548b1f37624d55d95fba, bucket_name: musor-bucket

Как решить проблему?

Answer 1

[Николай Бараненко]

решение оказалось на поверхности
для метода bucket_exists маловато
разрешений

"Action": [
     "s3:GetObject",
     "s3:ListBucket",
     "s3:PutObject"
    ]

необходимо заменить на
"s3:*"

{
  "Version": "2012-10-17",
  "Statement": [
   {
    "Sid": "AllowBucketSync",
    "Effect": "Allow",
    "Action": [
     "s3:*"
    ],
    "Resource": [
     "arn:aws:s3:::musor-bucket",
     "arn:aws:s3:::musor-bucket/*"
    ]
   }
  ]
 }