{"record":{"id":"d92f7333640cb3b4","repo":"argoproj/argo-workflows","slug":"failed-to-get-file-w-d92f73","errorCode":null,"errorMessage":"failed to get file: %w","messagePattern":"failed to get file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/s3/s3.go","lineNumber":214,"sourceCode":"\t\t\tif err != nil {\n\t\t\t\treturn !isTransientS3Err(ctx, err), fmt.Errorf(\"failed to create new S3 client: %w\", err)\n\t\t\t}\n\t\t\treturn loadS3Artifact(ctx, s3cli, inputArtifact, path)\n\t\t})\n\n\treturn err\n}\n\n// loadS3Artifact downloads artifacts from an S3 compliant storage\n// returns true if the download is completed or can't be retried (non-transient error)\n// returns false if it can be retried (transient error)\nfunc loadS3Artifact(ctx context.Context, s3cli Client, inputArtifact *wfv1.Artifact, path string) (bool, error) {\n\torigErr := s3cli.GetFile(inputArtifact.S3.Bucket, inputArtifact.S3.Key, path)\n\tif origErr == nil {\n\t\treturn true, nil\n\t}\n\tif !IsS3ErrCode(origErr, \"NoSuchKey\") {\n\t\treturn !isTransientS3Err(ctx, origErr), fmt.Errorf(\"failed to get file: %w\", origErr)\n\t}\n\t// If we get here, the error was a NoSuchKey. The key might be an s3 \"directory\"\n\tisDir, err := s3cli.IsDirectory(inputArtifact.S3.Bucket, inputArtifact.S3.Key)\n\tif err != nil {\n\t\treturn !isTransientS3Err(ctx, err), fmt.Errorf(\"failed to test if %s is a directory: %w\", inputArtifact.S3.Key, err)\n\t}\n\tif !isDir {\n\t\t// It's neither a file, nor a directory. Return the original NoSuchKey error\n\t\treturn true, argoerrs.New(argoerrs.CodeNotFound, origErr.Error())\n\t}\n\n\tif err = s3cli.GetDirectory(inputArtifact.S3.Bucket, inputArtifact.S3.Key, path); err != nil {\n\t\treturn !isTransientS3Err(ctx, err), fmt.Errorf(\"failed to get directory: %w\", err)\n\t}\n\treturn true, nil\n}\n\n// OpenStream opens a stream reader for an artifact from S3 compliant storage","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/s3/s3.go#L196-L232","documentation":"Raised in loadS3Artifact when GetFile fails with an error code other than NoSuchKey. NoSuchKey is handled separately (the key might be an S3 'directory' and downloaded as such), so this error represents any other download failure: access denied, network errors, throttling, malformed requests, etc. It is returned inside the executor retry backoff and retried only when classified transient.","triggerScenarios":"Executor downloading an S3 input artifact and GetFile returns e.g. AccessDenied, InvalidAccessKeyId, 5xx, connection reset, or bucket/key mismatch errors — anything except NoSuchKey.","commonSituations":"IAM policy lacking s3:GetObject on the key; wrong bucket name or region; S3-compatible storage rejecting the signature (MinIO/v4 mismatch); throttling (SlowDown) or transient network failures; key pointing at a nonexistent object with a provider that doesn't return NoSuchKey.","solutions":["Inspect the wrapped origErr for the S3 error code and message","If AccessDenied: fix bucket policy/IAM so the executor's credentials can s3:GetObject the key","Verify bucket and key names, region, and endpoint correctness in the artifact spec","If the code is transient (5xx, throttling, network), rely on the executor's automatic retry or increase retry backoff","For S3-compatible stores, confirm signature version/path-style settings match the provider"],"exampleFix":"# before: policy without GetObject on the artifact prefix\nStatement: [{Effect: Allow, Action: [s3:ListBucket], Resource: [arn:aws:s3:::my-bucket]}]\n# after: grant GetObject on the artifact keys\nStatement: [{Effect: Allow, Action: [s3:GetObject], Resource: [arn:aws:s3:::my-bucket/my-artifacts/*]}]","handlingStrategy":"retry","validationCode":"// pre-flight: confirm the object exists and is readable with the same credentials\nsvc := s3.NewFromConfig(cfg)\n_, err := svc.HeadObject(ctx, &s3.HeadObjectInput{Bucket: aws.String(bucket), Key: aws.String(key)})\nif err != nil {\n    return fmt.Errorf(\"artifact key %s/%s not accessible: %w\", bucket, key, err)\n}","typeGuard":null,"tryCatchPattern":"err := driver.Load(ctx, artifact, path)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to get file\") {\n        // inspect wrapped S3 code; retry only transient codes (5xx, SlowDown, network)\n        // AccessDenied/InvalidAccessKeyId need IAM/credential fixes, not retries\n    }\n    return err\n}","preventionTips":["Grant s3:GetObject on the artifact key prefix to the executor's credentials/IRSA role","Verify bucket, key, and region in the artifact spec before submission","Pre-check key existence with HeadObject in pipeline tooling","For S3-compatible stores, align signature version and path-style addressing with the provider"],"tags":["s3","artifact","aws","download","permissions"],"backgroundTag":"s3-get-object-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}