You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When using go-getter within s3, to download a specific file, deeply nested inside a directory hierarchy, the current usage of go-getter requires some unnecessary wide s3 policies to work.
With the current usage, you need a policy similar to the one below to make downloading artficats work, since go-getter run in any Mode by default - meaning it will try to traverse the bucket to find the file, and other files (if it happen to be a directory)
Being able to control the Mode would allow us to drop the ListObjects policy from our aws instances, and further harden our security footprint.
Looking at the code in go-getter, it seem like it tries, by default, to be recursive and download multiple files in the bucket if the source in nomad artifact happened to be a folder rather than a file
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.
Nomad version
Nomad v0.5.6
Issue
When using go-getter within s3, to download a specific file, deeply nested inside a directory hierarchy, the current usage of go-getter requires some unnecessary wide s3 policies to work.
With the current usage, you need a policy similar to the one below to make downloading artficats work, since go-getter run in
any Mode
by default - meaning it will try to traverse the bucket to find the file, and other files (if it happen to be a directory)Being able to control the
Mode
would allow us to drop theListObjects
policy from our aws instances, and further harden our security footprint.Looking at the code in go-getter, it seem like it tries, by default, to be recursive and download multiple files in the bucket if the
source
in nomad artifact happened to be a folder rather than a fileReproduction steps
any mode (current in nomad)
Without
ListObjects
policy:WIth
ListObjects
policy:dir mode
Without
ListObjects
policy:WIth
ListObjects
policy:file mode
Without
ListObjects
policy:With
ListObjects
policy:The text was updated successfully, but these errors were encountered: