Access Denied when IAM policy give access (Read/Write/Listing) to only a prefix area

Open
#847 14 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
aws, python
Domain
cloud

Research direction

Start by reproducing the restricted-prefix behavior with s3fs.S3FileSystem and fs.ls, using the IAM policy and versions shown in the issue. Compare the generated S3 listing request for paths with and without the trailing slash, then trace the relevant s3fs listing entry point. Done means identifying whether the denied request is expected or a s3fs bug and demonstrating the result with a focused regression check.

Written by the indexing model from the issue text.

Description

Say I have the following IAM policy for a user named "test-user" (as a Python dict instead of JSON, for concision):

{'Version': '2012-10-17',
 'Statement': [{'Effect': 'Allow',
   'Action': ['s3:PutObject', 's3:GetObject', 's3:DeleteObject'],
   'Resource': ['arn:aws:s3:::my_bucket/some/prefix/${aws:username}/*']},
  {'Effect': 'Allow',
   'Action': 's3:ListBucket',
   'Resource': 'arn:aws:s3:::my_bucket',
   'Condition': {'StringLike': {'s3:prefix': ['some/prefix/${aws:username}/*']}}}]}

This works just fine:

import boto3

prefix = 'some/prefix/test-user'
prefix_slash = f'{prefix}/'

# valid path
boto3.client('s3').list_objects_v2(Bucket='my_bucket', Prefix=prefix_slash)

# should be unreadable
try:
    boto3.client('s3').list_objects_v2(Bucket='my_bucket', Prefix=prefix)
    assert RuntimeError(f'{prefix} (no slash) was expected to fail')
except ClientError:
    pass

But the following code gives me Access Denied:

import s3fs

fs = s3fs.S3FileSystem(client_kwargs={'region_name': 'us-east-1'})

topdir = 'my_bucket/some/prefix/test-user'
fs.ls(f'{topdir}/')

If, however, I change the listing permission in IAM so the whole bucket can be listed:

[..., {'Effect': 'Allow',
   'Action': 's3:ListBucket',
   'Resource': 'arn:aws:s3:::my_bucket'}
]

Then it instantly works.

Another puzzling thing is, if I change the IAM permission back, the code above keeps working, even after starting a new Python interpreter.

Versions
import s3fs
import botocore

>>> {m.__name__: m.__version__ for m in [s3fs, botocore]}
{'s3fs': '2023.4.0', 'botocore': '1.29.76'}
Dominant language
Python
Stars
1k
Forks
305
Avg merge
22h 37m
Merged PRs (30d)
4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from fsspec/s3fs

All issues in fsspec/s3fs

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.