{"record":{"id":"f405ee2bc3a79c76","repo":"apache/hadoop","slug":"permission-denied-user-s-path-s-s-s-s-s-f405ee","errorCode":null,"errorMessage":"Permission denied: user=%s, path=\\\"%s\\\":%s:%s:%s%s","messagePattern":"Permission denied: user=(.+?), path=\\\\\"(.+?)\\\\\":(.+?):(.+?):(.+?)(.+?)","errorType":"exception","errorClass":"AccessControlException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AFileSystem.java","lineNumber":3912,"sourceCode":"\n  /**\n   * Soft check of access by forwarding to the audit manager\n   * and so on to the auditor.\n   * {@inheritDoc}\n   */\n  @Override\n  @AuditEntryPoint\n  public void access(final Path f, final FsAction mode)\n      throws AccessControlException, FileNotFoundException, IOException {\n    Path path = qualify(f);\n    LOG.debug(\"check access mode {} for {}\", path, mode);\n    trackDurationAndSpan(\n        INVOCATION_ACCESS, path, () -> {\n          final S3AFileStatus stat = innerGetFileStatus(path, false,\n              StatusProbeEnum.ALL);\n          if (!getAuditManager().checkAccess(path, stat, mode)) {\n            incrementStatistic(AUDIT_ACCESS_CHECK_FAILURE);\n            throw new AccessControlException(String.format(\n                \"Permission denied: user=%s, path=\\\"%s\\\":%s:%s:%s%s\",\n                getOwner().getUserName(),\n                stat.getPath(),\n                stat.getOwner(), stat.getGroup(),\n                stat.isDirectory() ? \"d\" : \"-\", mode));\n          }\n          // simply for the API binding.\n          return true;\n        });\n  }\n\n  /**\n   * Return a file status object that represents the path.\n   * @param f The path we want information from\n   * @return a FileStatus object\n   * @throws FileNotFoundException when the path does not exist\n   * @throws IOException on other problems.\n   */","sourceCodeStart":3894,"sourceCodeEnd":3930,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/S3AFileSystem.java#L3894-L3930","documentation":"FileSystem.access(path, mode) resolves the status (StatusProbeEnum.ALL) then delegates to the audit manager's checkAccess(path, stat, mode). When the configured audit/authorization layer denies the requested FsAction, S3A increments the audit_access_check_failure statistic and throws AccessControlException formatted with the acting user, path, owner, group, a 'd'/'-' directory indicator and the requested mode. The default no-op audit manager returns true, so this exception means an authorizing auditor is active and rejected the request.","triggerScenarios":"fs.access(path, FsAction.READ/WRITE/EXECUTE) when the active authorization layer denies that mode for the current user; frameworks (Hive, policy engines, distcp permission checks) calling access() before performing operations.","commonSituations":"Cluster-wide authorization/auditing plugin enabled after code worked unauthenticated; object owner/group differing from the acting user under enforced authorization; jobs migrated from permissive clusters.","solutions":["Compare the acting user (getOwner().getUserName() in the message) against the authorization policy and grant the needed access","Fix ownership expectations: ensure the creating user and the accessing user align with the policy","If the denial is unexpected, inspect the fs.s3a.audit.* / authorizer configuration to confirm which layer rejected it"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Deliberate permission probe with a clear failure\ntry {\n  fs.access(path, FsAction.READ);\n} catch (AccessControlException e) {\n  LOG.warn(\"denied: {}\", e.getMessage()); // contains user/owner/group/mode\n  throw e;\n}","typeGuard":"static boolean isAccessDenied(Throwable t) {\n  return t instanceof org.apache.hadoop.security.AccessControlException;\n}","tryCatchPattern":"Catch AccessControlException specifically (before IOException) wherever access() or an authorized operation runs; parse user/owner/group from the message for the error report, and surface it as a policy/authorization problem, not an S3 outage.","preventionTips":["Run fs.access() early (job setup) rather than deep in task code","Keep authorization plugin configuration and object ownership aligned","Watch the S3A audit metrics (audit_access_check_failure) for systematic denials"],"tags":["s3a","authorization","access-control","permissions","audit"],"backgroundTag":"permission-denied","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}