You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "Steve Loughran (Jira)" <ji...@apache.org> on 2020/03/16 20:13:00 UTC
[jira] [Commented] (HADOOP-16926) s3guard can't init table if
caller doesn't have tag permissions
[ https://issues.apache.org/jira/browse/HADOOP-16926?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17060449#comment-17060449 ]
Steve Loughran commented on HADOOP-16926:
-----------------------------------------
{code}
2020-03-16 20:02:42,115 [setup] ERROR s3guard.S3Guard (S3Guard.java:getMetadataStore(133)) - Failed to instantiate metadata store org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStore defined in fs.s3a.metadatastore.impl: java.nio.file.AccessDeniedException: stevel-london: com.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException: User: arn:aws:iam:::user/stevel-dev is not authorized to perform: dynamodb:TagResource on resource: arn:aws:dynamodb:eu-west-2::table/stevel-london (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException; Request ID: 162C0J4OU9M92E758JEP4AVJ3FVV4KQNSO5AEMVJF66Q9ASUAAJG)
java.nio.file.AccessDeniedException: stevel-london: com.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException: User: arn:aws:iam:::user/stevel-dev is not authorized to perform: dynamodb:TagResource on resource: arn:aws:dynamodb:eu-west-2::table/stevel-london (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException; Request ID: 162C0J4OU9M92E758JEP4AVJ3FVV4KQNSO5AEMVJF66Q9ASUAAJG)
at org.apache.hadoop.fs.s3a.S3AUtils.translateDynamoDBException(S3AUtils.java:453)
at org.apache.hadoop.fs.s3a.S3AUtils.translateException(S3AUtils.java:210)
at org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStoreTableManager.initTable(DynamoDBMetadataStoreTableManager.java:237)
at org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStore.initialize(DynamoDBMetadataStore.java:437)
at org.apache.hadoop.fs.s3a.s3guard.S3Guard.getMetadataStore(S3Guard.java:122)
at org.apache.hadoop.fs.s3a.S3AFileSystem.initialize(S3AFileSystem.java:432)
at org.apache.hadoop.fs.FileSystem.createFileSystem(FileSystem.java:3414)
at org.apache.hadoop.fs.FileSystem.access$200(FileSystem.java:158)
at org.apache.hadoop.fs.FileSystem$Cache.getInternal(FileSystem.java:3474)
at org.apache.hadoop.fs.FileSystem$Cache.get(FileSystem.java:3442)
at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:524)
at org.apache.hadoop.fs.contract.AbstractBondedFSContract.init(AbstractBondedFSContract.java:72)
at org.apache.hadoop.fs.contract.AbstractFSContractTestBase.setup(AbstractFSContractTestBase.java:187)
at org.apache.hadoop.fs.s3a.AbstractS3ATestBase.setup(AbstractS3ATestBase.java:59)
at org.apache.hadoop.fs.s3a.ITestS3AMiscOperations.setup(ITestS3AMiscOperations.java:64)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:24)
at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27)
at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:55)
at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:298)
at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:292)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.lang.Thread.run(Thread.java:748)
Caused by: com.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException: User: arn:aws:iam::152813717728:user/stevel-dev is not authorized to perform: dynamodb:TagResource on resource: arn:aws:dynamodb:eu-west-2::table/stevel-london (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException; Request ID: 162C0J4OU9M92E758JEP4AVJ3FVV4KQNSO5AEMVJF66Q9ASUAAJG)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1712)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1367)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1113)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:770)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:744)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:726)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:686)
at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:668)
at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:532)
at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:512)
at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.doInvoke(AmazonDynamoDBClient.java:4279)
at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.invoke(AmazonDynamoDBClient.java:4246)
at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.executeCreateTable(AmazonDynamoDBClient.java:1059)
at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.createTable(AmazonDynamoDBClient.java:1025)
at com.amazonaws.services.dynamodbv2.document.DynamoDB.createTable(DynamoDB.java:96)
at org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStoreTableManager.createTable(DynamoDBMetadataStoreTableManager.java:324)
at org.apache.hadoop.fs.s3a.s3guard.DynamoDBMetadataStoreTableManager.initTable(DynamoDBMetadataStoreTableManager.java:226)
... 26 more
2020-03-16 20:02:42,120 [setup] WARN fs.FileSystem (FileSystem.java:createFileSystem(3418)) - Failed to initialize fileystem s3a://stevel-london/: java.nio.file.AccessDeniedException: stevel-london: com.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException: User: arn:aws:iam:::user/stevel-dev is not authorized to perform: dynamodb:TagResource on resource: arn:aws:dynamodb:eu-west-2::table/stevel-london (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException; Request ID: 162C0J4OU9M92E758JEP4AVJ3FVV4KQNSO5AEMVJF66Q9ASUAAJG)
{code}
> s3guard can't init table if caller doesn't have tag permissions
> ---------------------------------------------------------------
>
> Key: HADOOP-16926
> URL: https://issues.apache.org/jira/browse/HADOOP-16926
> Project: Hadoop Common
> Issue Type: Sub-task
> Components: fs/s3
> Reporter: Steve Loughran
> Priority: Major
>
> If the user doesn't have the permissions to tag a DDB table creation will fail.
> Caused by HADOOP-16520; we downgrade the failure on other inits, HADOOP-16653, but not on actual creation.
> We could downgrade creation the same way
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org