{"record":{"id":"8ddea5956137e9b0","repo":"Tencent/WeKnora","slug":"failed-to-copy-file-in-s3-w","errorCode":null,"errorMessage":"failed to copy file in S3: %w","messagePattern":"failed to copy file in S3: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/file/s3.go","lineNumber":315,"sourceCode":") (string, error) {\n\tsrcKey, err := s.parseS3FilePath(srcPath)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"s3 copy rejected source %q: %w\", srcPath, ErrCrossBackendCopy)\n\t}\n\n\text := filepath.Ext(srcPath)\n\tdestKey := fmt.Sprintf(\"%s%d/%s/%s%s\", s.pathPrefix, tenantID, knowledgeID, uuid.New().String(), ext)\n\n\t// CopySource is \"bucket/key\"; the '/' separators must NOT be percent-encoded\n\t// (url.PathEscape would turn them into %2F and break the bucket/key split).\n\t// srcKey is already validated by parseS3FilePath -> SafeObjectKey.\n\t_, err = s.client.CopyObject(ctx, &s3.CopyObjectInput{\n\t\tBucket:     aws.String(s.bucketName),\n\t\tCopySource: aws.String(s.bucketName + \"/\" + srcKey),\n\t\tKey:        aws.String(destKey),\n\t})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to copy file in S3: %w\", err)\n\t}\n\n\tnewPath := fmt.Sprintf(\"s3://%s/%s\", s.bucketName, destKey)\n\tlogger.Infof(ctx, \"Copied S3 object %s to %s\", srcPath, newPath)\n\treturn newPath, nil\n}\n\n// SaveBytes saves bytes data to S3 and returns the file path\n// temp parameter is ignored for S3 (no auto-expiration support in this implementation)\nfunc (s *s3FileService) SaveBytes(ctx context.Context, data []byte, tenantID uint64, fileName string, temp bool) (string, error) {\n\tsafeName, err := utils.SafeFileName(fileName)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid file name: %w\", err)\n\t}\n\text := filepath.Ext(safeName)\n\tobjectName := fmt.Sprintf(\"%s%d/exports/%s%s\", s.pathPrefix, tenantID, uuid.New().String(), ext)\n\n\t// Upload bytes to S3","sourceCodeStart":297,"sourceCodeEnd":333,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/file/s3.go#L297-L333","documentation":"CopyFile wraps errors from the S3 CopyObject API call. The source key parsed successfully but the server-side copy failed — commonly missing s3:GetObject on the source, missing s3:PutObject on the destination, or object >5GB requiring multipart copy. The S3 error is chained via %w.","triggerScenarios":"CopyObject failing due to AccessDenied on source or destination, NoSuchKey on srcKey, KMS encryption key permission issues, or CopySource size exceeding the 5GB single-request limit.","commonSituations":"KMS-encrypted objects copied by a principal lacking kms:Decrypt/kms:Encrypt; cross-account or cross-region source without proper permissions; very large uploaded files breaking the 5GB CopyObject limit.","solutions":["Grant the IAM role both s3:GetObject on the source key and s3:PutObject on the destination prefix","Unwrap errors.As(smithy.APIError) to see the exact S3 error code (AccessDenied/NoSuchKey/InvalidRequest)","For objects >5GB, implement multipart upload copy (UploadPartCopy) instead of single CopyObject","For SSE-KMS buckets, verify kms:Decrypt and kms:Encrypt grants on the key"],"exampleFix":"// before\nnewPath, err := svc.CopyFile(ctx, src, tenantID, kid)\nif err != nil { return err }\n// after\nnewPath, err := svc.CopyFile(ctx, src, tenantID, kid)\nif err != nil {\n    var apiErr smithy.APIError\n    if errors.As(err, &apiErr) && apiErr.ErrorCode() == \"InvalidRequest\" {\n        // fall back to multipart copy for large objects\n    }\n    return err\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"newPath, err := svc.CopyFile(ctx, srcPath, tenantID, kid)\nif err != nil {\n    var apiErr smithy.APIError\n    if errors.As(err, &apiErr) && apiErr.ErrorCode() == \"AccessDenied\" {\n        return fmt.Errorf(\"missing s3 permissions for copy: %w\", err)\n    }\n    return err\n}","preventionTips":["IAM needs s3:GetObject on source prefix and s3:PutObject on destination prefix","For SSE-KMS buckets grant kms:Decrypt/kms:Encrypt","Avoid CopyFile for objects >5GB; use multipart copy","Ensure source file still exists before copy"],"tags":["aws","s3","permissions","copy"],"backgroundTag":"s3-copyobject-failed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}