{"action":"created","issue":{"url":"https://api.github.com/repos/ncw/rclone/issues/1421","repository_url":"https://api.github.com/repos/ncw/rclone","labels_url":"https://api.github.com/repos/ncw/rclone/issues/1421/labels{/name}","comments_url":"https://api.github.com/repos/ncw/rclone/issues/1421/comments","events_url":"https://api.github.com/repos/ncw/rclone/issues/1421/events","html_url":"https://github.com/ncw/rclone/issues/1421","id":229877222,"number":1421,"title":"\"rclone copy\" should not require HEAD permissions in the destination bucket","user":{"login":"jamshid","id":8549,"avatar_url":"https://avatars0.githubusercontent.com/u/8549?v=4","gravatar_id":"","url":"https://api.github.com/users/jamshid","html_url":"https://github.com/jamshid","followers_url":"https://api.github.com/users/jamshid/followers","following_url":"https://api.github.com/users/jamshid/following{/other_user}","gists_url":"https://api.github.com/users/jamshid/gists{/gist_id}","starred_url":"https://api.github.com/users/jamshid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jamshid/subscriptions","organizations_url":"https://api.github.com/users/jamshid/orgs","repos_url":"https://api.github.com/users/jamshid/repos","events_url":"https://api.github.com/users/jamshid/events{/privacy}","received_events_url":"https://api.github.com/users/jamshid/received_events","type":"User","site_admin":false},"labels":[{"id":86399007,"url":"https://api.github.com/repos/ncw/rclone/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-05-19T05:50:17Z","updated_at":"2018-02-22T21:19:36Z","closed_at":null,"author_association":"NONE","body":"Hi, using rclone 1.36 on macOS. I have an S3 bucket that allows anonymous writes, but not reads or any other permissions (see policy below). \r\n\r\nAttempting to copy a file into this bucket fails because rclone tries to HEAD the object or bucket. I'm using `~/.rclone.conf`:\r\n\r\n```\r\n[anons3]\r\ntype = s3\r\naccess_key_id = \r\nsecret_access_key = \r\nendpoint = https://s3.amazonaws.com\r\n```\r\n\r\nBtw that is nice, I didn't expect \"anonymous\" (no access key) to work in .rclone.conf, but it does.\r\n\r\n```\r\n$ rclone -vv --dump-headers copy ~/Pictures/snopes.png anons3:blinddrop/snopes.jpg\r\n2017/05/19 00:29:08 DEBUG : rclone: Version \"v1.36\" starting with parameters [\"rclone\" \"-vv\" \"--dump-headers\" \"copy\" \"/Users/jamshid/Pictures/snopes.png\" \"anons3:blinddrop/snopes.jpg\"]\r\n2017/05/19 00:29:08 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n2017/05/19 00:29:08 DEBUG : HTTP REQUEST (req 0xc420171600)\r\n2017/05/19 00:29:08 DEBUG : HEAD /blinddrop/snopes.jpg HTTP/1.1\r\nHost: s3.amazonaws.com\r\nUser-Agent: rclone/v1.36\r\n\r\n2017/05/19 00:29:08 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n2017/05/19 00:29:12 DEBUG : <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\r\n2017/05/19 00:29:12 DEBUG : HTTP RESPONSE (req 0xc420171600)\r\n2017/05/19 00:29:12 DEBUG : HTTP/1.1 403 Forbidden\r\nTransfer-Encoding: chunked\r\nContent-Type: application/xml\r\nDate: Fri, 19 May 2017 05:29:11 GMT\r\nServer: AmazonS3\r\nX-Amz-Id-2: LD+/NH6b5YxwwzFPGmMbmD/IA8wm6FXBZYX743kgIYXlSSRcl/A+6nvD8GN337GWkPdiEqNdYVM=\r\nX-Amz-Request-Id: BAF7A56D12ED2C49\r\n...\r\n2017/05/19 00:29:12 ERROR : Attempt 3/3 failed with 1 errors and: Forbidden: Forbidden\r\n\tstatus code: 403, request id: 80077ED0146A7613\r\n2017/05/19 00:29:12 Failed to copy: Forbidden: Forbidden\r\n\tstatus code: 403, request id: 80077ED0146A7613\r\n```\r\n\r\nI tried using `--no-traverse` but that didn't help.\r\n\r\nThis is similar to https://github.com/ncw/rclone/issues/610, thanks for fixing that. I guess this is what you meant in a comment there -- each operation like `copy` or `delete` will need a similar code change.\r\n\r\n```\r\n{\r\n  \"Id\": \"This policy for a 'blinddrop' bucket lets anonymous users upload objects but limits listings to underneath the 'public-domain' path. Note anonymous uploads are 'owned' by anonymous, so they can be read anonymously even outside the 'public-domain' path.\",\r\n\r\n  \"Statement\": [\r\n    { \"Sid\": \"Anonymous allowed to read any object underneath 'public-domain' path\",\r\n      \"Effect\": \"Allow\",\r\n      \"Resource\": \"arn:aws:s3:::blinddrop/public-domain/*\",\r\n      \"Principal\": \"*\",\r\n      \"Action\": [ \"s3:GetObject\" ]\r\n    },\r\n    { \"Sid\": \"Anonymous can only list objects underneath 'public-domain'\",\r\n      \"Effect\": \"Allow\",\r\n      \"Resource\": \"arn:aws:s3:::blinddrop\",\r\n      \"Principal\": \"*\" ,\r\n      \"Action\": [ \"s3:ListBucket\" ],\r\n      \"Condition\": {\r\n        \"StringLike\": { \"s3:prefix\": [ \"public-domain/\" ] }\r\n      }\r\n    },\r\n    { \"Sid\": \"Anonymous allowed to write / overwrite, update metadata anywhere in bucket\",\r\n      \"Effect\": \"Allow\",\r\n      \"Resource\": \"arn:aws:s3:::blinddrop/*\",\r\n      \"Principal\": \"*\",\r\n      \"Action\": [ \"s3:PutObject\" ]\r\n    }\r\n  ]\r\n}\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/ncw/rclone/issues/comments/367825597","html_url":"https://github.com/ncw/rclone/issues/1421#issuecomment-367825597","issue_url":"https://api.github.com/repos/ncw/rclone/issues/1421","id":367825597,"user":{"login":"jnellen","id":4950585,"avatar_url":"https://avatars2.githubusercontent.com/u/4950585?v=4","gravatar_id":"","url":"https://api.github.com/users/jnellen","html_url":"https://github.com/jnellen","followers_url":"https://api.github.com/users/jnellen/followers","following_url":"https://api.github.com/users/jnellen/following{/other_user}","gists_url":"https://api.github.com/users/jnellen/gists{/gist_id}","starred_url":"https://api.github.com/users/jnellen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jnellen/subscriptions","organizations_url":"https://api.github.com/users/jnellen/orgs","repos_url":"https://api.github.com/users/jnellen/repos","events_url":"https://api.github.com/users/jnellen/events{/privacy}","received_events_url":"https://api.github.com/users/jnellen/received_events","type":"User","site_admin":false},"created_at":"2018-02-22T21:19:36Z","updated_at":"2018-02-22T21:19:36Z","author_association":"NONE","body":"Hi all - I'm facing a similar issue with HEAD permissions, any update on the patch?  "}}
{"actor":{"display_login":"jnellen"}}