{"action":"opened","issue":{"url":"https://api.github.com/repos/anchore/anchore-engine/issues/94","repository_url":"https://api.github.com/repos/anchore/anchore-engine","labels_url":"https://api.github.com/repos/anchore/anchore-engine/issues/94/labels{/name}","comments_url":"https://api.github.com/repos/anchore/anchore-engine/issues/94/comments","events_url":"https://api.github.com/repos/anchore/anchore-engine/issues/94/events","html_url":"https://github.com/anchore/anchore-engine/issues/94","id":366095398,"node_id":"MDU6SXNzdWUzNjYwOTUzOTg=","number":94,"title":"BUG: S3 _check_creds doesn't work if you are not the owner of the S3 bucket","user":{"login":"nyanshak","id":3431490,"node_id":"MDQ6VXNlcjM0MzE0OTA=","avatar_url":"https://avatars0.githubusercontent.com/u/3431490?v=4","gravatar_id":"","url":"https://api.github.com/users/nyanshak","html_url":"https://github.com/nyanshak","followers_url":"https://api.github.com/users/nyanshak/followers","following_url":"https://api.github.com/users/nyanshak/following{/other_user}","gists_url":"https://api.github.com/users/nyanshak/gists{/gist_id}","starred_url":"https://api.github.com/users/nyanshak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nyanshak/subscriptions","organizations_url":"https://api.github.com/users/nyanshak/orgs","repos_url":"https://api.github.com/users/nyanshak/repos","events_url":"https://api.github.com/users/nyanshak/events{/privacy}","received_events_url":"https://api.github.com/users/nyanshak/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-02T21:55:20Z","updated_at":"2018-10-02T21:55:20Z","closed_at":null,"author_association":"NONE","body":"anchore-cli, version 0.2.4\r\n\r\nName: anchore-engine\r\nVersion: 0.2.4\r\n\r\n** Problem **\r\n\r\nThe s3 driver's _check_creds function in anchore_engine/subsys/object_store/drivers/s3.py calls:\r\n```\r\nself.s3_client.get_bucket_location(Bucket=self.bucket_name)\r\n```\r\n\r\nThis line causes a BadCredentialsError to be raised if you're not the owner of the bucket (for example, you have access via AssumeRole from another account). [AWS Docs](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketGETlocation.html) state that:\r\n\r\n> To use this implementation of the operation, you must be the bucket owner.\r\n\r\nAs someone who has access to a bucket but is not the owner, I'm unable to use the s3 driver in anchore.\r\n\r\n** Proposed solution **\r\n\r\nInstead of calling get_bucket_location, replace do something like (pseudocode):\r\n```\r\nkey = \"__anchore_s3_key_self_check__{}\".format(some_random_string)\r\n\r\ntry:\r\n    self.put(someUserId, bucket, key, \"anchore self-check data\")\r\n    data == self.get(someUserId, bucket, key)\r\n    if not data == \"anchore self-check data\":\r\n        raise SomeException\r\nexcept:\r\n    # do something here\r\nfinally:\r\n    self.delete(someUserId, bucket, key)\r\n```"}}
{"actor":{"display_login":"nyanshak"}}