{"record":{"id":"147813bcb0ba42b2","repo":"kubernetes/kops","slug":"error-listing-s-v-147813","errorCode":null,"errorMessage":"error listing %s: %v","messagePattern":"error listing (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/s3fs.go","lineNumber":453,"sourceCode":"\t\treturn nil, err\n\t}\n\n\tprefix := p.key\n\tif prefix != \"\" && !strings.HasSuffix(prefix, \"/\") {\n\t\tprefix += \"/\"\n\t}\n\trequest := &s3.ListObjectsV2Input{}\n\trequest.Bucket = aws.String(p.bucket)\n\trequest.Prefix = aws.String(prefix)\n\trequest.Delimiter = aws.String(\"/\")\n\n\tklog.V(4).Infof(\"Listing objects in S3 bucket %q with prefix %q\", p.bucket, prefix)\n\tvar paths []Path\n\tpaginator := s3.NewListObjectsV2Paginator(client, request)\n\tfor paginator.HasMorePages() {\n\t\tpage, err := paginator.NextPage(ctx)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error listing %s: %v\", p, err)\n\t\t}\n\t\tfor _, o := range page.Contents {\n\t\t\tkey := aws.ToString(o.Key)\n\t\t\tif key == prefix {\n\t\t\t\t// We have reports (#548 and #520) of the directory being returned as a file\n\t\t\t\t// And this will indeed happen if the directory has been created as a file,\n\t\t\t\t// which seems to happen if you use some external tools to manipulate the S3 bucket.\n\t\t\t\t// We need to tolerate that, so skip the parent directory.\n\t\t\t\tklog.V(4).Infof(\"Skipping read of directory: %q\", key)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tchild := &S3Path{\n\t\t\t\ts3Context: p.s3Context,\n\t\t\t\tbucket:    p.bucket,\n\t\t\t\tkey:       key,\n\t\t\t\tetag:      o.ETag,\n\t\t\t\tscheme:    p.scheme,\n\t\t\t\tsse:       p.sse,","sourceCodeStart":435,"sourceCodeEnd":471,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/s3fs.go#L435-L471","documentation":"S3Path.ReadDir lists objects under a key prefix using the S3 ListObjectsV2 paginator. This error is returned when any page of the paginated listing fails, wrapping the underlying AWS SDK error (permissions, missing bucket, networking). The listing is aborted and no partial result is returned.","triggerScenarios":"Calling ReadDir on an S3Path when ListObjectsV2 NextPage returns an error: AccessDenied on the bucket/prefix, NoSuchBucket, throttling (SlowDown), or a network failure while iterating pages.","commonSituations":"IAM policy missing s3:ListBucket on the state-store bucket; bucket deleted or renamed while the kOps cluster spec still points at it; S3 request-rate throttling on very large buckets; region mismatch causing endpoint errors.","solutions":["Check the wrapped AWS error code in the message; for AccessDenied grant s3:ListBucket (and s3:ListBucket/GetBucketLocation) on the bucket to the calling principal.","Verify the bucket name and region in the state store configuration (kops --state s3://...) — NoSuchBucket means the bucket no longer exists or is misspelled.","For SlowDown/throttling errors, retry with exponential backoff or reduce listing concurrency.","Confirm AWS credentials and configured region match the bucket's actual region."],"exampleFix":"// before (IAM policy)\n{\"Effect\":\"Deny\",\"Action\":\"s3:ListBucket\",\"Resource\":\"arn:aws:s3:::my-state-bucket\"}\n// after\n{\"Effect\":\"Allow\",\"Action\":[\"s3:ListBucket\",\"s3:GetBucketLocation\"],\"Resource\":\"arn:aws:s3:::my-state-bucket\"}","handlingStrategy":"try-catch","validationCode":"// preflight permissions before listing\n_, err := client.HeadBucket(ctx, &s3.HeadBucketInput{Bucket: aws.String(bucket)})\nif err != nil { // bucket missing or no permission — fix IAM/config first }\niamSimulate := policySimulatorAllows(\"s3:ListBucket\", bucketARN) // e.g. IAM Access Analyzer / SimulatePrincipalPolicy","typeGuard":"func isS3ListDenied(err error) bool {\n    return err != nil && (vfs.AWSErrorCode(err) == \"AccessDenied\" || strings.Contains(err.Error(), \"AccessDenied\"))\n}","tryCatchPattern":"paths, err := s3Path.ReadDir()\nif err != nil {\n    switch vfs.AWSErrorCode(err) {\n    case \"AccessDenied\":\n        return fmt.Errorf(\"grant s3:ListBucket on %s: %w\", bucket, err)\n    case \"NoSuchBucket\":\n        return fmt.Errorf(\"state store bucket %s does not exist\", bucket)\n    default:\n        return err // transient — safe to retry\n    }\n}","preventionTips":["Verify s3:ListBucket + s3:GetBucketLocation in the IAM policy before operating on a state store.","Pin the bucket's region and confirm existence with aws s3api head-bucket during setup.","Watch for SlowDown on large buckets and back off instead of hot-looping.","Validate the --state URL once at CLI startup rather than deep in operations."],"tags":["aws","s3","iam","listing","permissions"],"backgroundTag":"s3-listobjects-access-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}