-
Notifications
You must be signed in to change notification settings - Fork 833
blob/s3blob: map S3 403 errors PermissionDenied code#3663
Merged
vangent merged 1 commit intogoogle:masterfrom Feb 27, 2026
Merged
blob/s3blob: map S3 403 errors PermissionDenied code#3663vangent merged 1 commit intogoogle:masterfrom
vangent merged 1 commit intogoogle:masterfrom
Conversation
If the S3 credentials used to access a bucket doesn't have the
`s3:ListBucket` credentials, previously the error code would return as
`Unknown`. This commit changes this to PermissionDenied.
`s3:ListBucket` credentials, previously the error code would return as
`Unknown`. This commit changes this to PermissionDenied.
gitlab-runner-bot
pushed a commit
to gitlabhq/gitlab-runner
that referenced
this pull request
Mar 4, 2026
When using S3 with RoleARN, if the file doesn't exist, the Attributes
call returns a 403 Forbidden error instead of 404 Not Found. This can be
confusing because it may indicate either a missing file or incorrect IAM
permissions.
Add special handling for S3 403 errors to provide guidance that the
error may be expected if the file doesn't exist, and reference the
documentation about HeadObject permissions and the s3:ListBucket IAM
policy requirement.
This helps users distinguish between a missing cache file and actual
permission issues with their RoleARN configuration.
For now we use a string comparison because GoCloud returns an Unknown
code until google/go-cloud#3663 is merged.
Relates to https://gitlab.com/gitlab-org/gitlab-runner/-/issues/39105
call returns a 403 Forbidden error instead of 404 Not Found. This can be
confusing because it may indicate either a missing file or incorrect IAM
permissions.
Add special handling for S3 403 errors to provide guidance that the
error may be expected if the file doesn't exist, and reference the
documentation about HeadObject permissions and the s3:ListBucket IAM
policy requirement.
This helps users distinguish between a missing cache file and actual
permission issues with their RoleARN configuration.
For now we use a string comparison because GoCloud returns an Unknown
code until google/go-cloud#3663 is merged.
Relates to https://gitlab.com/gitlab-org/gitlab-runner/-/issues/39105
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.