Skip to content

Remove credential config of GetBucketRegion by default #3081

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 5, 2025

Conversation

wty-Bryant
Copy link
Contributor

The s3 transfer manager helper func GetBucketRegion is ported from go v1 but missed default anonymous credential config, this PR patches the config back so user could get a public bucket's region without credentials.
Fixes #3077

@wty-Bryant wty-Bryant requested a review from a team as a code owner May 3, 2025 01:23
Comment on lines 74 to +80
clientOptionFns[0] = func(options *s3.Options) {
options.APIOptions = append(options.APIOptions, captureBucketRegion.RegisterMiddleware)
}
copy(clientOptionFns[1:], optFns)
clientOptionFns[1] = func(options *s3.Options) {
options.Credentials = nil
}
copy(clientOptionFns[2:], optFns)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for fixing the bug!

Out of curiosity, is there a reason why we don't just set options.Credentials = nil directly in clientOptionFns[0]?

Suggested change
clientOptionFns[0] = func(options *s3.Options) {
options.APIOptions = append(options.APIOptions, captureBucketRegion.RegisterMiddleware)
}
copy(clientOptionFns[1:], optFns)
clientOptionFns[1] = func(options *s3.Options) {
options.Credentials = nil
}
copy(clientOptionFns[2:], optFns)
clientOptionFns[0] = func(options *s3.Options) {
options.APIOptions = append(options.APIOptions, captureBucketRegion.RegisterMiddleware)
options.Credentials = nil
}
copy(clientOptionFns[1:], optFns)

Copy link
Contributor Author

@wty-Bryant wty-Bryant May 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's just a idioms when I want to add a new functional config

@cartermckinnon
Copy link
Member

cartermckinnon commented Jun 19, 2025

@lucix-aws this broke things for private buckets in cn-northwest-1. The HeadBucket behavior is different there, you must provide credentials or you receive a 401 (and there is no x-amz-bucket-region header in the response).

It works as expected in cn-north-1 (even for buckets that reside in cn-northwest-1). I reached out to the S3 team as well, not clear if this is expected behavior.

I can work around this by explicitly using the client's credentials for the call:

cfg, _ := config.LoadDefaultConfig(context.TODO())
region, err := manager.GetBucketRegion(context.TODO(), s3.NewFromConfig(cfg), bucketName, func(o *s3.Options) {
	o.Credentials = cfg.Credentials
})

But this worked with defaults prior to feature/s3/manager@v1.17.75.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

MIGRATION ISSUE: GetBucketRegion in v2 requires valid credentials
4 participants