0

Very annoying permissions issue here:

  • I've been granted access to specific subfolders of an S3 bucket.
  • I don't appear to have permissions to the bucket in general.
  • I am able to navigate via AWS GUI web interface and upload/download/rename files as I wish.
  • I cannot appear to get anything done via boto3 without running into permissions issues.

Anybody know a workaround for this? If possible I'd like to be able to proceed without waiting on permissions to be granted.

Python Code:

import boto3

client = boto3.client(
    's3',
    aws_access_key_id = 'ACCESSKEY',
    aws_secret_access_key = 'SECRET',
    region_name = 'us-east-1'
)

resource = boto3.resource(
    's3',
    aws_access_key_id = 'ACCESSKEY',
    aws_secret_access_key = 'SECRET',
    region_name = 'us-east-1'
)

client.download_file("BUCKETNAME", "/FOLDER/PATH/FILENAME.json", "LOCALFILENAME")

Response:

ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden

Note: A similar problem occurred in this post: Python boto, list contents of specific dir in bucket. A solution from boto 2.x was to disable the check for permissions of the bucket via "validate = False", but that is obsolete now in boto3. Looking for a similar type solution, I suppose.

Michael Hayes
  • 123
  • 1
  • 7
  • 1
    `get_object` should work without HeadObject permissions. `download_file` is a convenience function. – jordanm Sep 05 '21 at 21:28
  • Can you explain what is a higher level Bucket – smac2020 Sep 05 '21 at 21:56
  • 1
    **Translation:** The `download_file()` command probably uses several API calls, including `HeadObject` (for which you do not have permission). This is a "higher-level function", in that it uses several API calls to perform its operation. Try accessing the object using `get_object()` instead, which directly maps to a single API call. (In the AWS CLI, this equates to `aws s3api get-object`.) – John Rotenstein Sep 05 '21 at 21:58
  • @smac2020 mybucket is the bucket, mybucket/path/to/file.json is what I am able to access. – Michael Hayes Sep 06 '21 at 00:26

0 Answers0