oracle / oracle/oci-python-sdk

OCI CLI not working with Instance Principal Auth

Open
#539 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Object Storage
Dominant language
Python
Stars
474
Forks
321
Avg merge
23m
Merged PRs (30d)
4

Description

OCI_CLI_AUTH=instance_principal
[opc@cloudnenamingvm ~]$ oci os object list --bucket-name cloudnetnamingDND

/home/opc/lib/oracle-cli/lib64/python3.6/site-packages/oci/_vendor/httpsig_cffi/sign.py:10: CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography. The next release of cryptography (40.0) will be the last to support Python 3.6.
from cryptography.hazmat.backends import default_backend # noqa: F401
ServiceError:
{
"client_version": "Oracle-PythonSDK/2.99.1, Oracle-PythonCLI/3.25.4",
"code": "BucketNotFound",
"logging_tips": "Please run the OCI CLI command using --debug flag to find more debug information.",
"message": "Either the bucket named 'cloudnetnamingDND' does not exist in the namespace 'axmbu1eyltbl' or you are not authorized to access it",
"opc-request-id": "phx-1:0oGfeV3SHeyjG8IZVI_1GycoUtg-VgWxY38n_peiSVdgUaMSTk8__D5aXqPiv3d8",
"operation_name": "list_objects",
"request_endpoint": "GET https://objectstorage.us-phoenix-1.oraclecloud.com/n/axmbu1eyltbl/b/cloudnetnamingDND/o",
"status": 404,
"target_service": "object_storage",
"timestamp": "2023-06-01T06:47:10.851532+00:00",
"troubleshooting_tips": "See [https://docs.oracle.com/iaas/Content/API/References/apierrors.htm] for more information about resolving this error. If you are unable to resolve this issue, run this CLI command with --debug option and contact Oracle support and provide them the full error message."
}

When I am using config file, it works fine. Group has the user and dynamic group has the OCID of my VM. Same policy statements are given for both, yet config file works but instance principal method doesn’t .
Can someone help in debugging?

Screenshot 2023-06-01 at 12 04 48 PM

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the OCI CLI command shown in the report and rerun it with --debug, comparing instance principal authentication with the working config-file path. Review the reported BucketNotFound response, namespace, bucket, policies, and dynamic-group setup. Done means the same object-list operation works with instance principal authentication under the stated permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.