{"record":{"id":"0c2a332b7337b2dd","repo":"juicedata/juicefs","slug":"failed-to-put-s","errorCode":null,"errorMessage":"Failed to put: %s","messagePattern":"Failed to put: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/format.go","lineNumber":337,"sourceCode":"\t}\n\treturn false\n}\n\nvar letters = []rune(\"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\")\n\nfunc randSeq(n int) string {\n\tb := make([]rune, n)\n\tr := rand.New(rand.NewSource(time.Now().UnixNano()))\n\tfor i := range b {\n\t\tb[i] = letters[r.Intn(len(letters))]\n\t}\n\treturn string(b)\n}\n\nfunc doTesting(ctx context.Context, store object.ObjectStorage, key string, data []byte) error {\n\tif err := store.Put(ctx, key, bytes.NewReader(data)); err != nil {\n\t\tif strings.Contains(strings.ToLower(err.Error()), \"denied\") {\n\t\t\treturn fmt.Errorf(\"Failed to put: %s\", err)\n\t\t}\n\t\tif err2 := store.Create(ctx); err2 != nil {\n\t\t\tif strings.Contains(err.Error(), \"NoSuchBucket\") {\n\t\t\t\treturn fmt.Errorf(\"Failed to create bucket %s: %s, previous error: %s\\nPlease create bucket %s manually, then format again.\",\n\t\t\t\t\tstore, err2, err, store)\n\t\t\t} else {\n\t\t\t\treturn fmt.Errorf(\"Failed to create bucket %s: %s, previous error: %s\",\n\t\t\t\t\tstore, err2, err)\n\t\t\t}\n\t\t}\n\t\tif err := store.Put(ctx, key, bytes.NewReader(data)); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to put: %s\", err)\n\t\t}\n\t}\n\t// GLACIER storage class doesn't allow read after write\n\tif _, ok := ctx.Value(object.TierKey{}).(uint8); ok {\n\t\treturn nil\n\t}","sourceCodeStart":319,"sourceCodeEnd":355,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/cmd/format.go#L319-L355","documentation":"During format-time connectivity testing, the initial Put of a test object failed with an error containing 'denied', indicating the credentials lack write permission to the target bucket. The command aborts rather than attempting bucket creation, since the failure is authorization, not existence.","triggerScenarios":"`juicefs format` against an object store whose access keys have read-only policy (e.g. IAM user without s3:PutObject), a bucket with PutObject denied by bucket policy, or a MinIO user without write policy on the path.","commonSituations":"AWS IAM policies restricting PutObject; bucket policies denying the principal; MinIO canned policies like `readonly`; KMS/encryption policies blocking unencrypted puts.","solutions":["Grant write access to the principal (e.g. attach s3:PutObject to the IAM policy or MinIO write policy)","Check the bucket policy for explicit Deny statements on PutObject","If the bucket enforces SSE-KMS, ensure the key policy allows the principal, or configure server-side encryption settings","Verify with the AWS/MinIO CLI: `aws s3 cp testfile s3://bucket/test`"],"exampleFix":"// before (IAM policy)\n{\"Effect\":\"Deny\",\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::mybucket/*\"}\n// after\n{\"Effect\":\"Allow\",\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::mybucket/*\"}","handlingStrategy":"try-catch","validationCode":"// pre-check write access with provider CLI\n// aws s3api put-object --bucket mybucket --key write-test --body /dev/null","typeGuard":"func isAccessDenied(err error) bool {\n    return err != nil && strings.Contains(strings.ToLower(err.Error()), \"denied\")\n}","tryCatchPattern":"err := doTesting(ctx, store, key, data)\nif err != nil && strings.Contains(strings.ToLower(err.Error()), \"denied\") {\n    // fix IAM/bucket policy before retrying\n}","preventionTips":["Grant s3:PutObject to the principal before formatting","Test credentials with the provider CLI first","Check bucket policies for explicit Deny on the principal","For MinIO, attach a write-capable policy (e.g. readwrite) to the user"],"tags":["object-storage","permissions","s3"],"backgroundTag":"permission-denied","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}