argoproj/argo-workflows · error

failed to get file: %w

Error message

failed to get file: %w

What it means

Raised in loadS3Artifact when GetFile fails with an error code other than NoSuchKey. NoSuchKey is handled separately (the key might be an S3 'directory' and downloaded as such), so this error represents any other download failure: access denied, network errors, throttling, malformed requests, etc. It is returned inside the executor retry backoff and retried only when classified transient.

Source

Thrown at workflow/artifacts/s3/s3.go:214

			if err != nil {
				return !isTransientS3Err(ctx, err), fmt.Errorf("failed to create new S3 client: %w", err)
			}
			return loadS3Artifact(ctx, s3cli, inputArtifact, path)
		})

	return err
}

// loadS3Artifact downloads artifacts from an S3 compliant storage
// returns true if the download is completed or can't be retried (non-transient error)
// returns false if it can be retried (transient error)
func loadS3Artifact(ctx context.Context, s3cli Client, inputArtifact *wfv1.Artifact, path string) (bool, error) {
	origErr := s3cli.GetFile(inputArtifact.S3.Bucket, inputArtifact.S3.Key, path)
	if origErr == nil {
		return true, nil
	}
	if !IsS3ErrCode(origErr, "NoSuchKey") {
		return !isTransientS3Err(ctx, origErr), fmt.Errorf("failed to get file: %w", origErr)
	}
	// If we get here, the error was a NoSuchKey. The key might be an s3 "directory"
	isDir, err := s3cli.IsDirectory(inputArtifact.S3.Bucket, inputArtifact.S3.Key)
	if err != nil {
		return !isTransientS3Err(ctx, err), fmt.Errorf("failed to test if %s is a directory: %w", inputArtifact.S3.Key, err)
	}
	if !isDir {
		// It's neither a file, nor a directory. Return the original NoSuchKey error
		return true, argoerrs.New(argoerrs.CodeNotFound, origErr.Error())
	}

	if err = s3cli.GetDirectory(inputArtifact.S3.Bucket, inputArtifact.S3.Key, path); err != nil {
		return !isTransientS3Err(ctx, err), fmt.Errorf("failed to get directory: %w", err)
	}
	return true, nil
}

// OpenStream opens a stream reader for an artifact from S3 compliant storage

View on GitHub (pinned to 35bff19146)

Solutions

1. Inspect the wrapped origErr for the S3 error code and message
2. If AccessDenied: fix bucket policy/IAM so the executor's credentials can s3:GetObject the key
3. Verify bucket and key names, region, and endpoint correctness in the artifact spec
4. If the code is transient (5xx, throttling, network), rely on the executor's automatic retry or increase retry backoff
5. For S3-compatible stores, confirm signature version/path-style settings match the provider

Example fix

# before: policy without GetObject on the artifact prefix
Statement: [{Effect: Allow, Action: [s3:ListBucket], Resource: [arn:aws:s3:::my-bucket]}]
# after: grant GetObject on the artifact keys
Statement: [{Effect: Allow, Action: [s3:GetObject], Resource: [arn:aws:s3:::my-bucket/my-artifacts/*]}]

// pre-flight: confirm the object exists and is readable with the same credentials
svc := s3.NewFromConfig(cfg)
_, err := svc.HeadObject(ctx, &s3.HeadObjectInput{Bucket: aws.String(bucket), Key: aws.String(key)})
if err != nil {
    return fmt.Errorf("artifact key %s/%s not accessible: %w", bucket, key, err)
}

err := driver.Load(ctx, artifact, path)
if err != nil {
    if strings.Contains(err.Error(), "failed to get file") {
        // inspect wrapped S3 code; retry only transient codes (5xx, SlowDown, network)
        // AccessDenied/InvalidAccessKeyId need IAM/credential fixes, not retries
    }
    return err
}

When it happens

Trigger: Executor downloading an S3 input artifact and GetFile returns e.g. AccessDenied, InvalidAccessKeyId, 5xx, connection reset, or bucket/key mismatch errors — anything except NoSuchKey.

Common situations: IAM policy lacking s3:GetObject on the key; wrong bucket name or region; S3-compatible storage rejecting the signature (MinIO/v4 mismatch); throttling (SlowDown) or transient network failures; key pointing at a nonexistent object with a provider that doesn't return NoSuchKey.

Related errors

• failed get directory: %w
• failed to create new S3 client: %w
• failed to test if %s is a directory: %w
• unable to list files in %s: %w
• failed to create bucket %s: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/d92f7333640cb3b4. Report an issue: GitHub.