activeloopai / activeloopai/deeplake

S3: GetBucketLocation required despite explicit aws_region, and the raised error names the wrong cause

未關閉
#3,163 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
C++
星號
9.2k
分支
722
PR 合併指標
30 天內沒有已合併 PR

描述

**Version:** 4.7.0 · Linux aarch64, Python 3.12 · S3 storage

Two small things, same failure.

## 1. `s3:GetBucketLocation` is required even when the region is supplied

```python
creds = {"aws_access_key_id": ..., "aws_secret_access_key": ...,
"aws_session_token": ..., "aws_region": "us-east-1"} # region given
deeplake.create(url, creds=creds, schema={...})
```

```
[S3] Failed to get bucket region for URL: // with error:
[S3] Access denied: User: ... is not authorized to perform:
s3:GetBucketLocation on resource: "arn:aws:s3:::"
```

If the caller states the region, the lookup should be skipped. It is an extra permission on the bucket resource (not the object prefix), which means a least-privilege policy has to grant a bucket-level action purely to satisfy a call that was not needed.

## 2. The exception names the wrong cause

The message above goes to **stderr**. What the caller catches is:

```
deeplake._deeplake.StorageAccessDenied:
[S3] Access denied: _deeplake_log/_meta/0000000001c00000000.jsonl No response body.
```

So a program sees "cannot read `_deeplake_log/_meta/…`" when the actual denial was `s3:GetBucketLocation` on the bucket. Debugging a policy from that message sends you to the wrong statement — we first widened object permissions, twice, before finding the real one on stderr.

`No response body` is also misleading: there was a response, it was a 403.

## Ask

1. Skip the region lookup when `aws_region` is supplied.
2. Carry the underlying S3 error — action, resource, status — in the raised exception, not only on stderr.

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。