Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lambda-promtail: s3 bucket ownership verification not working #15382

Open
milenpankov-bosch opened this issue Dec 12, 2024 · 0 comments · May be fixed by #15383
Open

lambda-promtail: s3 bucket ownership verification not working #15382

milenpankov-bosch opened this issue Dec 12, 2024 · 0 comments · May be fixed by #15383

Comments

@milenpankov-bosch
Copy link
Contributor

The lambda-promtail implementation uses s3 bucket ownership verification when copying logs from s3 buckets, but it is incorrectly using the s3 bucket ownerIdentity principal id as aws account id which produces the following error:

api error InvalidBucketOwnerAWSAccountID: The value of the expected bucket owner parameter must be an AWS Account ID...

S3 bucket ownership verification seems to be only possible by verifying the aws account id:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-owner-condition.html
However the S3 event notification message which the current implementation uses to get the AWS S3 account id doesn't actually contain it:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-content-structure.html
https://docs.aws.amazon.com/lambda/latest/dg/with-s3.html

It seems that there is no way to get the AWS account id from the S3 event notification message as it is considered sensitive information.
Suggestion is to remove the s3 bucket ownership verification, otherwise the implementation will always produce an error.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant