zfarrell commented on PR #771: URL: https://github.com/apache/arrow-rs-object-store/pull/771#issuecomment-5027637823
Thanks again @alamb, and thanks for the non_exhaustive change / merge-up. On why your run failed: I believe the key detail is that every failure in your log is 403 AccessDenied, not SignatureDoesNotMatch. S3 validated the SigV4 signature and then refused on authorization, meaning the IAM principal behind those temporary credentials did not have permission on aal-test-bucket. A wrong signature returns SignatureDoesNotMatch. On top of that, several of the failures panic on the plain create_multipart call (POST ?uploads=), which is not presigned at all, so those shouldn't (?!) be a presigning bug. I confirmed the code works by running the full suite against real S3 in one of our sandbox accounts using SSO/STS temporary credentials (the same ASIA... plus session-token shape you had). All 10 tests pass, including the enforcement ones, and I also ran it against MinIO locally. To make that much less painful, I pushed a few changes: 1. **Fail-fast preflight.** The test helper now does an authenticated PutObject probe before the real assertions. If the credentials cannot write to the bucket it fails immediately with an actionable message (bucket name, the permissions the tests need, and the override env var) instead of the opaque 403 deep inside whichever test runs first. Your setup would have failed in one line telling you why. 2. **Configurable bucket**. OBJECT_STORE_SIGNING_BUCKET overrides the default test-bucket-for-signing, so you can point at your own bucket without editing the source. 3. **CI coverage**, which addresses the bitrot concern directly. The enforcement tests now run automatically in CI against MinIO, which validates SigV4 where LocalStack does not. CONTRIBUTING now documents a plain-HTTP MinIO setup for local repro and for pointing at real S3. 4. **Docs**. Following your suggestion (and building on #801), the end-to-end presigned-multipart example now lives on AmazonS3::create_multipart, right after your example: same upload, but presigning each UploadPart for a credential-less client. signed_url_opts links to it. CONTRIBUTING also lists the exact S3 permissions the tests need against real S3 (s3:PutObject, s3:GetObject, s3:DeleteObject, s3:AbortMultipartUpload), with a minimal IAM policy (likely the AccessDenied you hit if you were on a scoped-down policy). Happy to adjust any of these. In particular the CI-on-MinIO step is a new pattern for this repo, so let me know if you would rather keep it out of CI and docs-only. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
