{"record":{"id":"6376191d074646f4","repo":"kubernetes/kops","slug":"from-aws-s3-getbucketpolicystatuswithcontext-w","errorCode":null,"errorMessage":"from AWS S3 GetBucketPolicyStatusWithContext: %w","messagePattern":"from AWS S3 GetBucketPolicyStatusWithContext: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/s3fs.go","lineNumber":605,"sourceCode":"\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to resolve endpoint for %q: %w\", p.String(), err)\n\t}\n\n\tendpoint.URI.Path = path.Join(endpoint.URI.Path, p.Key())\n\treturn endpoint.URI.String(), nil\n}\n\nfunc (p *S3Path) IsBucketPublic(ctx context.Context) (bool, error) {\n\tclient, err := p.client(ctx)\n\tif err != nil {\n\t\treturn false, err\n\t}\n\n\tresult, err := client.GetBucketPolicyStatus(ctx, &s3.GetBucketPolicyStatusInput{\n\t\tBucket: aws.String(p.bucket),\n\t})\n\tif err != nil && AWSErrorCode(err) != \"NoSuchBucketPolicy\" {\n\t\treturn false, fmt.Errorf(\"from AWS S3 GetBucketPolicyStatusWithContext: %w\", err)\n\t}\n\tif err == nil && aws.ToBool(result.PolicyStatus.IsPublic) {\n\t\treturn true, nil\n\t}\n\treturn false, nil\n\n\t// We could check bucket ACLs also...\n\n\t// acl, err := client.GetBucketAclWithContext(ctx, &s3.GetBucketAclInput{\n\t// \tBucket: &p.bucket,\n\t// })\n\t// if err != nil {\n\t// \treturn false, fmt.Errorf(\"failed to get ACL for bucket %q: %w\", p.bucket, err)\n\t// }\n\n\t// allowsAnonymousRead := false\n\t// for _, grant := range acl.Grants {\n\t// \tisAllUsers := false","sourceCodeStart":587,"sourceCodeEnd":623,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/s3fs.go#L587-L623","documentation":"S3Path.IsBucketPublic checks whether a bucket's bucket policy marks it public using GetBucketPolicyStatus. Any AWS error other than NoSuchBucketPolicy is wrapped and returned; NoSuchBucketPolicy is treated as 'not public' by design. Note the message mentions the legacy *_WithContext name although the call is GetBucketPolicyStatus on the v2 SDK.","triggerScenarios":"Calling IsBucketPublic when GetBucketPolicyStatus returns an error other than NoSuchBucketPolicy: AccessDenied (policy status requires s3:GetBucketPolicyStatus), NoSuchBucket, or a networking/API failure.","commonSituations":"Auditing public accessibility of the kops state bucket with an IAM identity lacking GetBucketPolicyStatus; checking a bucket in another account; buckets where Block Public Policy denies policy reads.","solutions":["Grant the caller s3:GetBucketPolicyStatus (and s3:GetBucketPolicy) on the bucket to resolve AccessDenied.","If NoSuchBucket, verify the bucket name/region in the state store configuration.","Check account-level Block Public Policy settings if policy APIs are being denied by SCP or org policy.","Retry on transient 5xx/network errors reported in the wrapped message."],"exampleFix":"// before (IAM)\n{\"Action\":[\"s3:ListBucket\"],\"Resource\":\"arn:aws:s3:::my-bucket\"}\n// after\n{\"Action\":[\"s3:ListBucket\",\"s3:GetBucketPolicyStatus\",\"s3:GetBucketPolicy\"],\"Resource\":\"arn:aws:s3:::my-bucket\"}","handlingStrategy":"try-catch","validationCode":"result, err := iamSimulator.SimulatePrincipalPolicy(ctx, &iam.SimulatePrincipalPolicyInput{\n    PolicySourceArn: aws.String(roleArn),\n    ActionNames: []string{\"s3:GetBucketPolicyStatus\", \"s3:GetBucketPolicy\"},\n    ResourceArns: []string{bucketARN}, // both must be Evaluated/Allowed\n})","typeGuard":"func isNoSuchBucketPolicy(err error) bool {\n    return err != nil && vfs.AWSErrorCode(err) == \"NoSuchBucketPolicy\" // treat as not-public, not a failure\n}","tryCatchPattern":"isPublic, err := s3Path.IsBucketPublic()\nif err != nil {\n    if code := vfs.AWSErrorCode(err); code == \"AccessDenied\" {\n        return false, fmt.Errorf(\"grant s3:GetBucketPolicyStatus on %s: %w\", bucket, err)\n    }\n    return false, err\n}","preventionTips":["Include s3:GetBucketPolicyStatus and s3:GetBucketPolicy in read-only audit IAM policies.","Treat NoSuchBucketPolicy as 'not public' — it is handled internally; don't panic on it.","Check org SCPs / Block Public Policy when policy APIs are denied account-wide.","Confirm cross-account buckets are audited with credentials from the owning account."],"tags":["aws","s3","iam","policy","security"],"backgroundTag":"s3-bucket-policy-access-denied","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}