kubernetes/kops · error

from AWS S3 GetBucketPolicyStatusWithContext: %w

Error message

from AWS S3 GetBucketPolicyStatusWithContext: %w

What it means

S3Path.IsBucketPublic checks whether a bucket's bucket policy marks it public using GetBucketPolicyStatus. Any AWS error other than NoSuchBucketPolicy is wrapped and returned; NoSuchBucketPolicy is treated as 'not public' by design. Note the message mentions the legacy *_WithContext name although the call is GetBucketPolicyStatus on the v2 SDK.

Source

Thrown at util/pkg/vfs/s3fs.go:605

	if err != nil {
		return "", fmt.Errorf("failed to resolve endpoint for %q: %w", p.String(), err)
	}

	endpoint.URI.Path = path.Join(endpoint.URI.Path, p.Key())
	return endpoint.URI.String(), nil
}

func (p *S3Path) IsBucketPublic(ctx context.Context) (bool, error) {
	client, err := p.client(ctx)
	if err != nil {
		return false, err
	}

	result, err := client.GetBucketPolicyStatus(ctx, &s3.GetBucketPolicyStatusInput{
		Bucket: aws.String(p.bucket),
	})
	if err != nil && AWSErrorCode(err) != "NoSuchBucketPolicy" {
		return false, fmt.Errorf("from AWS S3 GetBucketPolicyStatusWithContext: %w", err)
	}
	if err == nil && aws.ToBool(result.PolicyStatus.IsPublic) {
		return true, nil
	}
	return false, nil

	// We could check bucket ACLs also...

	// acl, err := client.GetBucketAclWithContext(ctx, &s3.GetBucketAclInput{
	// 	Bucket: &p.bucket,
	// })
	// if err != nil {
	// 	return false, fmt.Errorf("failed to get ACL for bucket %q: %w", p.bucket, err)
	// }

	// allowsAnonymousRead := false
	// for _, grant := range acl.Grants {
	// 	isAllUsers := false

View on GitHub (pinned to 4c8573c808)

Solutions

1. Grant the caller s3:GetBucketPolicyStatus (and s3:GetBucketPolicy) on the bucket to resolve AccessDenied.
2. If NoSuchBucket, verify the bucket name/region in the state store configuration.
3. Check account-level Block Public Policy settings if policy APIs are being denied by SCP or org policy.
4. Retry on transient 5xx/network errors reported in the wrapped message.

Example fix

// before (IAM)
{"Action":["s3:ListBucket"],"Resource":"arn:aws:s3:::my-bucket"}
// after
{"Action":["s3:ListBucket","s3:GetBucketPolicyStatus","s3:GetBucketPolicy"],"Resource":"arn:aws:s3:::my-bucket"}

result, err := iamSimulator.SimulatePrincipalPolicy(ctx, &iam.SimulatePrincipalPolicyInput{
    PolicySourceArn: aws.String(roleArn),
    ActionNames: []string{"s3:GetBucketPolicyStatus", "s3:GetBucketPolicy"},
    ResourceArns: []string{bucketARN}, // both must be Evaluated/Allowed
})

func isNoSuchBucketPolicy(err error) bool {
    return err != nil && vfs.AWSErrorCode(err) == "NoSuchBucketPolicy" // treat as not-public, not a failure
}

isPublic, err := s3Path.IsBucketPublic()
if err != nil {
    if code := vfs.AWSErrorCode(err); code == "AccessDenied" {
        return false, fmt.Errorf("grant s3:GetBucketPolicyStatus on %s: %w", bucket, err)
    }
    return false, err
}

When it happens

Trigger: Calling IsBucketPublic when GetBucketPolicyStatus returns an error other than NoSuchBucketPolicy: AccessDenied (policy status requires s3:GetBucketPolicyStatus), NoSuchBucket, or a networking/API failure.

Common situations: Auditing public accessibility of the kops state bucket with an IAM identity lacking GetBucketPolicyStatus; checking a bucket in another account; buckets where Block Public Policy denies policy reads.

Related errors

• failed to get grant for key %q in bucket %q: %w
• failed to generate AWS IAM S3 access statements: %v
• unknown writeable path, can't apply IAM policy: %q
• checking if bucket was public: %w
• error parsing AssumeRolePolicyDocument for IAMRole %s: %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/6376191d074646f4. Report an issue: GitHub.