Skip to content

storage: treat 403 on HeadBucket as bucket-exists #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
temap wants to merge 1 commit into
base: main
Choose a base branch
from
Open

storage: treat 403 on HeadBucket as bucket-exists #38

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions pkg/storage/storage_s3.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,14 @@ func (s *s3Storage) ensureBucketExists(ctx context.Context) error {
if _, err := s.client.HeadBucket(ctx, headInput); err == nil {
s.bucketReady = true
return nil
} else {
// 403 on HeadBucket means the bucket exists but the caller lacks s3:ListBucket.
// Object-level permissions (PutObject/GetObject) are sufficient for caching.
var apiErr smithy.APIError
if errors.As(err, &apiErr) && apiErr.ErrorCode() == "Forbidden" {
s.bucketReady = true

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Don't accept no-ListBucket mode before fixing misses

When this branch accepts a bucket whose caller lacks s3:ListBucket, ordinary cache misses stop behaving like misses: AWS documents HeadObject as returning 403 for absent objects without s3:ListBucket (docs), but cacheInfoForKey only maps 404/NoSuchKey-style errors to ErrCacheNotFound. In that permission profile, protocols that call CacheInfo will surface normal misses as errors instead of allowing uploads, so mark the bucket ready only after the miss path handles 403 appropriately for this mode.

Useful? React with 👍 / 👎.

return nil
}
}

createInput := &s3.CreateBucketInput{
Expand Down