{"record":{"id":"d0d6e37854edb0fe","repo":"Tencent/WeKnora","slug":"failed-to-upload-bytes-to-s3-w","errorCode":null,"errorMessage":"failed to upload bytes to S3: %w","messagePattern":"failed to upload bytes to S3: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/file/s3.go","lineNumber":343,"sourceCode":"func (s *s3FileService) SaveBytes(ctx context.Context, data []byte, tenantID uint64, fileName string, temp bool) (string, error) {\n\tsafeName, err := utils.SafeFileName(fileName)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid file name: %w\", err)\n\t}\n\text := filepath.Ext(safeName)\n\tobjectName := fmt.Sprintf(\"%s%d/exports/%s%s\", s.pathPrefix, tenantID, uuid.New().String(), ext)\n\n\t// Upload bytes to S3\n\treader := bytes.NewReader(data)\n\t_, err = s.client.PutObject(ctx, &s3.PutObjectInput{\n\t\tBucket:        aws.String(s.bucketName),\n\t\tKey:           aws.String(objectName),\n\t\tBody:          reader,\n\t\tContentLength: aws.Int64(int64(len(data))),\n\t\tContentType:   aws.String(utils.GetContentTypeByExt(ext)),\n\t})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to upload bytes to S3: %w\", err)\n\t}\n\n\treturn fmt.Sprintf(\"s3://%s/%s\", s.bucketName, objectName), nil\n}\n\n// GetFileURL returns a presigned download URL for the file\nfunc (s *s3FileService) GetFileURL(ctx context.Context, filePath string) (string, error) {\n\tobjectName, err := s.parseS3FilePath(filePath)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\t// Create presign client\n\tpresignClient := s3.NewPresignClient(s.client)\n\n\t// Generate presigned URL\n\tpresignedReq, err := presignClient.PresignGetObject(ctx, &s3.GetObjectInput{\n\t\tBucket: aws.String(s.bucketName),","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/file/s3.go#L325-L361","documentation":"SaveBytes wraps errors from the S3 PutObject upload of the byte payload. The reader and metadata were constructed but the upload itself failed — permissions, size/quota limits, connectivity, or encryption configuration. Nothing is persisted and no s3:// path is returned.","triggerScenarios":"PutObject failing due to AccessDenied on the tenant prefix, payload exceeding bucket quota or max object size, KMS key access denied, or network failure to the S3 endpoint.","commonSituations":"IAM policy not granting PutObject on the exports/ prefix; large export files hitting bucket lifecycle/quota limits; SSE-KMS bucket where the role lacks kms:GenerateDataKey; endpoint unreachable from a private subnet.","solutions":["Verify IAM s3:PutObject permission on pathPrefix/tenantID/exports/*","Unwrap errors.As(smithy.APIError) to identify the exact S3 error code","Check object size against bucket quotas and S3 limits, and confirm KMS key grants if SSE-KMS is enabled","Confirm network/endpoint configuration and retry transient failures with backoff"],"exampleFix":"// before\npath, err := svc.SaveBytes(ctx, data, tenantID, name, false)\n// after\npath, err := svc.SaveBytes(ctx, data, tenantID, name, false)\nif err != nil {\n    var apiErr smithy.APIError\n    if errors.As(err, &apiErr) && apiErr.ErrorCode() == \"AccessDenied\" {\n        return fmt.Errorf(\"check s3:PutObject on %s/exports/*: %w\", tenantID, err)\n    }\n    return err\n}","handlingStrategy":"retry","validationCode":"if len(data) == 0 { return errors.New(\"empty payload\") }\nif _, err := utils.SafeFileName(fileName); err != nil { return err }","typeGuard":null,"tryCatchPattern":"var path string\nerr := retry.Do(3, backoff, func() error {\n    var e error\n    path, e = svc.SaveBytes(ctx, data, tenantID, name, false)\n    var apiErr smithy.APIError\n    if e != nil && errors.As(e, &apiErr) && isTransient(apiErr.ErrorCode()) {\n        return e // retry\n    }\n    return retry.Stop(e)\n})","preventionTips":["Retry only transient S3 errors (5xx, throttling, timeouts), never AccessDenied","Confirm IAM s3:PutObject on pathPrefix/tenantID/exports/* before rollout","Check bucket quotas and KMS grants for large uploads","Monitor S3 error rates and set size limits at the API layer"],"tags":["aws","s3","upload","network"],"backgroundTag":"s3-putobject-failed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}