putObject by aws client with ACL headers ,if the AccessControlList owner is real passed to s3?

[linger000]

Describe the feature

putObject by aws client with ACL headers ,if the owner is not real passed to s3?
because i debugger awsclient java code,just pass the grants by addAclHeader(xxxx),not find code to pass owner info

code:

 new PutObjectRequest(bucket, key, new File(filePath)).withAccessControlList(acl);

Use Case

i just begin to learn s3 documents

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS Java SDK version used

1.12.173

JDK version used

1.8

Operating System and version

mac intellij idea

[debora-ito]

Hi @linger000, I don't really understand the question. Are you trying to set ACL to the object but it's not working?
Can you provide a sample code showing what you're trying to do?

[debora-ito]

Just a heads up, I'm moving this to Github Discussions as it's not really a feature request.

[linger000]

my java demo code like this:

Owner owner=new Owner("id","name");
AccessControlList acl =new AccessControlList().withOwner(owner);
PutObjectRequest request= new PutObjectRequest(bucket, key, new File(filePath)).withAccessControlList(acl);
s3client.putObject(request);

i debug the AmazonClient.java,then i found the AccessControlList relation code is as the flowing,but i cannot found the putObjectRequest.getAccessControlList().getOwner() usage,just the headers generated from grants :

   if ( putObjectRequest.getAccessControlList() != null) {
            addAclHeaders(request, putObjectRequest.getAccessControlList());
        } else if ( putObjectRequest.getCannedAcl() != null ) {
            request.addHeader(Headers.S3_CANNED_ACL, putObjectRequest.getCannedAcl().toString());
        }

to compare the usage,i debug the s3client.setObjectAcl() ,then i found the relation code as the flowing,including ’acl.getOwner()‘ keyword:

public byte[] convertToXmlByteArray(AccessControlList acl) {
   Owner owner = **acl.getOwner();**
        if (owner == null) {
            throw new SdkClientException("Invalid AccessControlList: missing an S3Owner");
        }
...
}

so, i want to know if the AccessControlList owner is not real work int the putObject method?

[debora-ito]

If you're looking for a line number in the SDK code I cannot say without doing a deep dive.

Can you tell us more about the problem you're trying to solve?
Have you tried to set a AccessControlList in the putObject request and it didn't work? What did you see instead?
Can you share a code sample using the SDK that I can use to reproduce the issue?

[linger000]

i just want known the way to pass the AccessControlList.owner param to the s3 storage server using http request,when using putobject with AccessControlList param,
the same to the a line number in the 1.12.173 SDK code you said ,
because i cannot found in putobject code,but found in setObjectAcl code

[linger000]

  the code 

//step 1: new AccessControlList,owner is mine ,and grant to an other user

 AccessControlList acl = new AccessControlList();
acl.setOwner(myOwner);
CanonicalGrantee u1 = new CanonicalGrantee(OTHER_OWNER.getId());
u1.setDisplayName(OTHER_OWNER.getDisplayName());
 acl.grantPermission(u1, Permission.FullControl);

//step 2: put object with step1 acl
 PutObjectRequest request = new PutObjectRequest(bucket, key, new File(filePath));
request.withAccessControlList(acl);
PutObjectResult putObjectResult = client.putObject(request);

//step3: get the object,but response 403
S3Object s3object = client.getObject(bucket, key);

[debora-ito]

Status code 403 Forbidden means the account that called getObject() does not have permission to access the object.
PutObject does set the accessControlList as expected, you can confirm it my uploading the object and checking the Permission tab in aws console.

The bucket owner and the object writer has full control over the object, so if you're using a different account to call getObject() (probably the OTHER_OWNER account) I would check if the account really has access to the object as expected.

References:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html
https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-ownership-retrieving.html

[Pioneer-Even]

状态代码表示被调用的帐户没有访问该对象的权限。 PutObject 确实按预期设置了 accessControlList，您可以在上传对象并在 aws 控制台中检查权限选项卡时确认它。403 Forbidden``getObject()

存储桶拥有者和对象编写者对对象具有完全控制权，因此，如果您使用其他账户进行调用（可能是OTHER_OWNER账户），我会检查该账户是否真的能够按预期访问该对象。getObject()

参考资料： https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-ownership-retrieving.html

Hello, I also have a similar problem here. There is a need to migrate the data in one bucket to another bucket, and the migration permission is required, but I found that when constructing a request with PutObjectRequest and passing the accessControlList parameter, the data It is successfully migrated to another bucket, but the AccessControlList of the object has not been successfully migrated, and it is still the default Full-Control. How to solve this problem?
Later, I found an expedient solution, first migrate the data, and then call the client.setObjectAcl() method to successfully migrate the AccessControlList, but the time cost is proportional to the size of the data in the bucket, and the cost is very high, so is there a way What about an efficient migration solution?
Please answer the above two questions, thank you very much! ! !
Below is the sample code for the first question
My sdk version is 1.12.183，java version 1.8
Although I operate under the same account, using PutObjectRequest can only migrate successful data, and AccessControlList is still the default Full-Control

`
public class PutObjectWithAcl {
private static final AmazonS3 SOURCE = new S3Client("ak1", "sk1", "http://xxxx").buildS3Client();

private static final AmazonS3 TARGET = new S3Client("ak2", "sk2", "http://xxxx").buildS3Client();

private static final String SOURCE_BUCKET = "test1";

private static final String TARGET_BUCKET = "test2";

private static final Owner SOURCE_OWNER = SOURCE.getS3AccountOwner();

private static final Owner TARGET_OWNER = TARGET.getS3AccountOwner();

public static void main(String[] args) {
    String nextMarker = null;
    ObjectListing objectListing;
    do {
        ListObjectsRequest listObjectsRequest = new ListObjectsRequest();
        listObjectsRequest.withBucketName(SOURCE_BUCKET).withMarker(nextMarker);
        objectListing = SOURCE.listObjects(listObjectsRequest);
        for (S3ObjectSummary objectSummary : objectListing.getObjectSummaries()) {
            TARGET.putObject(buildPutObjectRequest(TARGET_BUCKET, objectSummary.getKey(),
                    SOURCE.getObject(SOURCE_BUCKET, objectSummary.getKey()),
                    buildAcl(SOURCE.getObjectAcl(SOURCE_BUCKET, objectSummary.getKey()))));
        }
    } while (objectListing.isTruncated());
}

private static AccessControlList buildAcl(AccessControlList controlList) {
    controlList.withOwner(TARGET_OWNER);
    for (Grant grant : controlList.getGrantsAsList()) {
        changeGrantOwner(grant.getGrantee());
    }
    return controlList;
}

private static void changeGrantOwner(Grantee grantee) {
    if (grantee instanceof CanonicalGrantee && grantee.getIdentifier().equals(SOURCE_OWNER.getId())) {
        grantee.setIdentifier(TARGET_OWNER.getId());
        ((CanonicalGrantee) grantee).setDisplayName(TARGET_OWNER.getDisplayName());
    }
}

private static PutObjectRequest buildPutObjectRequest(String bucket, String key, S3Object s3Object, AccessControlList sourceAcl) {
    PutObjectRequest putObjectRequest = new PutObjectRequest(bucket, key, s3Object.getObjectContent(), s3Object.getObjectMetadata());
    putObjectRequest.withAccessControlList(sourceAcl);
    return putObjectRequest;
}

}`