[
https://issues.apache.org/jira/browse/HADOOP-14661?focusedWorklogId=733895&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-733895
]
ASF GitHub Bot logged work on HADOOP-14661:
-------------------------------------------
Author: ASF GitHub Bot
Created on: 28/Feb/22 14:38
Start Date: 28/Feb/22 14:38
Worklog Time Spent: 10m
Work Description: dannycjones commented on a change in pull request #3962:
URL: https://github.com/apache/hadoop/pull/3962#discussion_r815946868
##########
File path:
hadoop-tools/hadoop-aws/src/site/markdown/tools/hadoop-aws/troubleshooting_s3a.md
##########
@@ -547,6 +547,20 @@ When trying to write or read SEE-KMS-encrypted data, the
client gets a
The caller does not have the permissions to access
the key with which the data was encrypted.
+### <a name="access_denied_requester_pays"></a>`AccessDeniedException` when
using a "Requester Pays" enabled bucket
+
+When making cross-account requests to a requester pays enabled bucket, all
calls must acknowledge via a header that the requester will be billed.
+
+If you don't enable this acknowledgement within S3A, then you will see a
message similar to this:
+
+```
+java.nio.file.AccessDeniedException: s3a://my-bucket/my-object: getFileStatus
on s3a://my-bucket/my-object:
Review comment:
Unfortunately, "403 Forbidden" is the only information given.
This will only appear if the header is not provided and the call is made by
a principal who is not the bucket owner. The bucket owner does not have to
provide the header.
Below is HTTP output from the AWS CLI when making a failed GetObject.
```
2022-02-28 14:35:11,318 - MainThread - urllib3.connectionpool - DEBUG -
https://<MY-BUCKET>.s3.eu-west-1.amazonaws.com:443 "GET /file.txt HTTP/1.1" 403
None
2022-02-28 14:35:11,319 - MainThread - botocore.parsers - DEBUG - Response
headers: {'x-amz-request-id': 'NC3P56B2VZ87PMKF', 'x-amz-id-2': '<TRUNCATED>',
'Content-Type': 'application/xml', 'Transfer-Encoding': 'chunked', 'Date':
'Mon, 28 Feb 2022 14:35:11 GMT', 'Server': 'AmazonS3'}
2022-02-28 14:35:11,320 - MainThread - botocore.parsers - DEBUG - Response
body:
b'<?xml version="1.0"
encoding="UTF-8"?>\n<Error><Code>AccessDenied</Code><Message>Access
Denied</Message><RequestId>NC3P56B2VZ87PMKF</RequestId></Error>'
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
Issue Time Tracking
-------------------
Worklog Id: (was: 733895)
Time Spent: 2h 20m (was: 2h 10m)
> S3A to support Requester Pays Buckets
> -------------------------------------
>
> Key: HADOOP-14661
> URL: https://issues.apache.org/jira/browse/HADOOP-14661
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: common, util
> Affects Versions: 3.0.0-alpha3
> Reporter: Mandus Momberg
> Assignee: Mandus Momberg
> Priority: Minor
> Labels: pull-request-available
> Attachments: HADOOP-14661.patch
>
> Original Estimate: 2h
> Time Spent: 2h 20m
> Remaining Estimate: 0h
>
> Amazon S3 has the ability to charge the requester for the cost of accessing
> S3. This is called Requester Pays Buckets.
> In order to access these buckets, each request needs to be signed with a
> specific header.
> http://docs.aws.amazon.com/AmazonS3/latest/dev/RequesterPaysBuckets.html
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
