Rclone Copy to MINIO S3 with writeonly policy

What is the problem you are having with rclone?

I am unable to rclone copy/rclone sync to a MINIO S3 server with a write only policy, my policy is attached at the bottom of the post.

Run the command 'rclone version' and share the full output of the command.

rclone v1.68.1
- os/version: debian 12.7 (64 bit)
- os/kernel: 6.1.0-22-amd64 (x86_64)
- os/type: linux
- os/arch: amd64
- go/version: go1.23.1
- go/linking: static
- go/tags: none

Which cloud storage system are you using? (eg Google Drive)

S3 MINIO (Version: RELEASE.2024-10-02T17-50-41Z (go1.22.8 linux/amd64))

The command you were trying to run (eg rclone copy /tmp remote:tmp)

rclone copy --s3-no-check-bucket --no-traverse --ignore-checksum --no-update-modtime --ignore-times vaultwarden.zip s3-backup:node-backup/at-vie3

Please run 'rclone config redacted' and share the full output. If you get command not found, please make sure to update rclone.

[s3-backup]
type = s3
acl = private
provider = Minio
env_auth = false
access_key_id = XXX
secret_access_key = XXX
endpoint = https://xxx.xxx.com
region = sk1
location_constraint = sk1

A log from the command that you were trying to run with the -vv flag

2024/10/11 22:04:46 DEBUG : rclone: Version "v1.68.1" starting with parameters ["rclone" "copy" "--s3-no-check-bucket" "--no-traverse" "--ignore-checksum" "--no-update-modtime" "--ignore-times" "backup.zip" "s3-backup:node-backup/at-vie3" "-vv"]
2024/10/11 22:04:46 DEBUG : Creating backend with remote "backup.zip"
2024/10/11 22:04:46 DEBUG : Using config file from "/root/.config/rclone/rclone.conf"
2024/10/11 22:04:46 DEBUG : fs cache: adding new entry for parent of "backup.zip", "/opt"
2024/10/11 22:04:46 DEBUG : Creating backend with remote "s3-backup:node-backup/at-vie3"
2024/10/11 22:04:46 DEBUG : s3-backup: detected overridden config - adding "{Dn7qA}" suffix to name
2024/10/11 22:04:46 DEBUG : fs cache: renaming cache item "s3-backup:node-backup/at-vie3" to be canonical "s3-backup{Dn7qA}:node-backup/at-vie3"
2024/10/11 22:04:46 ERROR : Attempt 1/3 failed with 1 errors and: operation error S3: HeadObject, https response error StatusCode: 403, RequestID: 17FD7EA6C015B0F4, HostID: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8, api error Forbidden: Forbidden
2024/10/11 22:04:46 ERROR : Attempt 2/3 failed with 1 errors and: operation error S3: HeadObject, https response error StatusCode: 403, RequestID: 17FD7EA6C0F1DAA5, HostID: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8, api error Forbidden: Forbidden
2024/10/11 22:04:46 ERROR : Attempt 3/3 failed with 1 errors and: operation error S3: HeadObject, https response error StatusCode: 403, RequestID: 17FD7EA6C1CC6A68, HostID: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8, api error Forbidden: Forbidden
2024/10/11 22:04:46 INFO  :
Transferred:              0 B / 0 B, -, 0 B/s, ETA -
Errors:                 1 (retrying may help)
Elapsed time:         0.1s

2024/10/11 22:04:46 DEBUG : 5 go routines active
2024/10/11 22:04:46 NOTICE: Failed to copy: operation error S3: HeadObject, https response error StatusCode: 403, RequestID: 17FD7EA6C1CC6A68, HostID: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8, api error Forbidden: Forbidden

I am also attaching the policy from the MINIO server, this policy is present on the service account. The policy of the user is readwrite (that is s3:* on all buckets), just to rule out any possible issues.

{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Allow",
   "Action": [
    "s3:GetBucketLocation",
    "s3:ListBucket",
    "s3:PutObject"
   ],
   "Resource": [
    "arn:aws:s3:::node-backup",
    "arn:aws:s3:::node-backup/*"
   ]
  }
 ]
}

Please excuse me if it's some kind of a stupid mistake, but I am out of ideas currently. Any response is greatly appreciated!
Thanks!

welcome to the forum,

somewhere in the forum, i wrote about how to to that. will try to find it.
in the mean time, there are a bunch of --s3-no flags, you should try

and for a deeper look at the api calls, try --dump=headers

1 Like

Hello, I just figured it out thanks to you pointing out the S3-no flags. This command works:

rclone copy backup.zip s3-backup:node-backup/at-vie3 --s3-no-check-bucket --s3-no-head --s3-no-head-object --s3-no-system-metadata

I had to add --s3-no-head --s3-no-head-object.
I somehow completely missed these. Thank you for letting me know! And sorry for wasting your time. Hopefully, other users will be able to find it

Unable to upload file to bucket with PUT only IAM policy
that is the topic where i solved a similar issue to yours.

1 Like

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.