zfarrell commented on PR #771:
URL: 
https://github.com/apache/arrow-rs-object-store/pull/771#issuecomment-5027637823

   Thanks again @alamb, and thanks for the non_exhaustive change / merge-up.
   
   On why your run failed: I believe the key detail is that every failure in 
your log is 403 AccessDenied, not SignatureDoesNotMatch. S3 validated the SigV4 
signature and then refused on authorization, meaning the IAM principal behind 
those temporary credentials did not have permission on aal-test-bucket. A wrong 
signature returns SignatureDoesNotMatch. On top of that, several of the 
failures panic on the plain create_multipart call (POST ?uploads=), which is 
not presigned at all, so those shouldn't (?!) be a presigning bug.
   
   I confirmed the code works by running the full suite against real S3 in one 
of our sandbox accounts using SSO/STS temporary credentials (the same ASIA... 
plus session-token shape you had). All 10 tests pass, including the enforcement 
ones, and I also ran it against MinIO locally. 
   
   To make that much less painful, I pushed a few changes:
   
   1. **Fail-fast preflight.** The test helper now does an authenticated 
PutObject probe before the real assertions. If the credentials cannot write to 
the bucket it fails immediately with an actionable message (bucket name, the 
permissions the tests need, and the override env var) instead of the opaque 403 
deep inside whichever test runs first. Your setup would have failed in one line 
telling you why.
   2. **Configurable bucket**. OBJECT_STORE_SIGNING_BUCKET overrides the 
default test-bucket-for-signing, so you can point at your own bucket without 
editing the source.
   3. **CI coverage**, which addresses the bitrot concern directly. The 
enforcement tests now run automatically in CI against MinIO, which validates 
SigV4 where LocalStack does not. CONTRIBUTING now documents a plain-HTTP MinIO 
setup for local repro and for pointing at real S3.
   4.  **Docs**. Following your suggestion (and building on #801), the 
end-to-end presigned-multipart example now lives on AmazonS3::create_multipart, 
right after your example: same upload, but presigning each UploadPart for a 
credential-less client. signed_url_opts links to it. CONTRIBUTING also lists 
the exact S3 permissions the tests need against real S3 (s3:PutObject, 
s3:GetObject, s3:DeleteObject, s3:AbortMultipartUpload), with a minimal IAM 
policy (likely the AccessDenied you hit if you were on a scoped-down policy).
   
   Happy to adjust any of these. In particular the CI-on-MinIO step is a new 
pattern for this repo, so let me know if you would rather keep it out of CI and 
docs-only.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to