{"record":{"id":"710132dfeabb73c5","repo":"kubernetes/kops","slug":"error-fetching-s-v","errorCode":null,"errorMessage":"error fetching %s: %v","messagePattern":"error fetching (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/pkg/vfs/s3fs.go","lineNumber":420,"sourceCode":"// WriteToWithContext implements io.WriterTo, but adds a context\nfunc (p *S3Path) WriteToWithContext(ctx context.Context, out io.Writer) (int64, error) {\n\tclient, err := p.client(ctx)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\n\tklog.V(4).Infof(\"Reading file %q\", p)\n\n\trequest := &s3.GetObjectInput{}\n\trequest.Bucket = aws.String(p.bucket)\n\trequest.Key = aws.String(p.key)\n\n\tresponse, err := client.GetObject(ctx, request)\n\tif err != nil {\n\t\tif AWSErrorCode(err) == \"NoSuchKey\" {\n\t\t\treturn 0, os.ErrNotExist\n\t\t}\n\t\treturn 0, fmt.Errorf(\"error fetching %s: %v\", p, err)\n\t}\n\tdefer response.Body.Close()\n\n\tn, err := io.Copy(out, response.Body)\n\tif err != nil {\n\t\treturn n, fmt.Errorf(\"error reading %s: %v\", p, err)\n\t}\n\treturn n, nil\n}\n\nfunc (p *S3Path) ReadDir() ([]Path, error) {\n\tctx := context.TODO()\n\tclient, err := p.client(ctx)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tprefix := p.key","sourceCodeStart":402,"sourceCodeEnd":438,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/util/pkg/vfs/s3fs.go#L402-L438","documentation":"WriteToWithContext downloads an object with GetObject. A NoSuchKey AWS error is translated to os.ErrNotExist; any other failure is wrapped as \"error fetching <path>: <underlying error>\". Note NoSuchBucket/AccessDenied are NOT mapped to ErrNotExist and surface here.","triggerScenarios":"Calling ReadFile/WriteTo on an S3Path when GetObject fails for reasons other than missing key: AccessDenied on the key; NoSuchBucket (wrong bucket name/region); KMS decryption failure; throttling; network errors.","commonSituations":"Pointing KOPS_STATE_STORE at a nonexistent or mistyped bucket; credentials lacking s3:GetObject; a cluster state file deleted by another process but versioning absent so GetObject 404s (that path returns ErrNotExist, not this); VPC endpoint misconfigurations.","solutions":["Read the wrapped AWS error: NoSuchBucket → fix the bucket name in KOPS_STATE_STORE; AccessDenied → grant s3:GetObject","Check os.IsNotExist(err) first — missing keys are returned as os.ErrNotExist, not this error","Verify bucket region matches the client region (wrong region gives AuthorizationHeaderMalformed/301)","Ensure KMS key policy allows decryption if the bucket enforces SSE-KMS"],"exampleFix":"// before\ndata, err := vfs.Context.ReadFile(p)\nif err != nil { return err } // conflates missing vs denied\n// after\nif _, err := vfs.Context.ReadFile(p); err != nil {\n\tif errors.Is(err, os.ErrNotExist) { return createDefaults() }\n\treturn fmt.Errorf(\"reading state %s: %w\", p, err)\n}","handlingStrategy":"try-catch","validationCode":"// Probe bucket existence/permissions before reads\n_, err := s3Client.HeadBucket(ctx, &s3.HeadBucketInput{Bucket: bucket})\nif err != nil { return fmt.Errorf(\"state store bucket %s unusable: %w\", bucket, err) }","typeGuard":null,"tryCatchPattern":"data, err := vfs.Context.ReadFile(p)\nif err != nil {\n\tif errors.Is(err, os.ErrNotExist) {\n\t\treturn nil, errStateNotFound // missing key path\n\t}\n\tif code := AWSErrorCode(errors.Unwrap(err)); code == \"NoSuchBucket\" || code == \"AccessDenied\" {\n\t\treturn nil, fmt.Errorf(\"state store misconfigured (%s): %w\", code, err)\n\t}\n\treturn nil, err\n}","preventionTips":["Check errors.Is(err, os.ErrNotExist) first — the library already maps NoSuchKey","Validate KOPS_STATE_STORE bucket name and region before cluster operations","Grant s3:GetObject on the state prefix to the reading principal","Confirm KMS key access when the bucket enforces SSE-KMS"],"tags":["aws","s3","read","iam","not-found"],"backgroundTag":"s3-getobject-failed","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}