mhart / aws4fetch

A compact AWS client and signing utility for modern JS environments
MIT License
577 stars 39 forks source link

Can't list all buckets with Object Read & Write R2 permissions #72

Closed austinm911 closed 1 week ago

austinm911 commented 1 week ago

When following along aws4fetch | Cloudflare R2 docs, I am unable to list all buckets with these permissions

import { AwsClient } from 'aws4fetch'

if (!process.env.CLOUDFLARE_ACCESS_KEY_ID || !process.env.CLOUDFLARE_SECRET_ACCESS_KEY) {
    throw new Error('CLOUDFLARE_ACCESS_KEY_ID or CLOUDFLARE_SECRET_ACCESS_KEY is not set')
}

const R2_URL_BASE = `https://${process.env.CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com`

const createR2UrlForBucket = (bucketName: string) => `${R2_URL_BASE}/${bucketName}`

export const S3 = new AwsClient({
    region: 'auto',
    service: 's3',
    accessKeyId: process.env.CLOUDFLARE_ACCESS_KEY_ID,
    secretAccessKey: process.env.CLOUDFLARE_SECRET_ACCESS_KEY,
})

const ListBucketsResult = await S3.fetch(R2_URL_BASE)
console.log(await ListBucketsResult.text()) //  <?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message></Error>

const ListObjectsV2Result = await S3.fetch(`${createR2UrlForBucket('MyBucket')}?list-type=2`)

console.log(await ListObjectsV2Result.text()) // this works

However, the admin permissions appear to work

Not sure if this is expected behavior. It would be expected the current permissions would work

mhart commented 1 week ago

An AccessDenied error occurs after any signature checks have occurred – so this is nothing to do with aws4fetch, which must be signing the request correctly.

I'd suggest finding help in the Cloudflare Discord or forums or similar