SSH.NET icon indicating copy to clipboard operation
SSH.NET copied to clipboard

No permissions to create file in Amazon S3 SFTP server using S3 file system?

Open kikaragyozov opened this issue 2 years ago • 4 comments

I get the following exception when using SftpClient.Create(string):

Renci.SshNet.Common.SshException: 'Cannot open file in mode: CREATE|EXCLUSIVE|READ|WRITE'

I've given full access for the transfer protocol as well as the s3 file system using these 2 policies: AmazonS3FullAccess

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*",
                "s3-object-lambda:*"
            ],
            "Resource": "*"
        }
    ]
}

AWSTransferFullAccess

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "transfer:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "transfer.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeAddresses"
            ],
            "Resource": "*"
        }
    ]
}

I can successfully create & delete a folder, but the moment I Try to do so with a file, I get the above error.

I can successfully create& delete a file using a SFTP explorer like WinSCP. What's going on here?

Using SftpClient.UploadFile or the async extension UploadAsync works without hiccups.

kikaragyozov avatar Oct 16 '23 08:10 kikaragyozov

I think after investigating, it's possible Amazon's servers do not support the EXCLUSIVE flag, which is weird.

kikaragyozov avatar Oct 16 '23 12:10 kikaragyozov

@kikaragyozov Did you manage to work around this issue?

mitchej7 avatar Feb 01 '24 17:02 mitchej7

@kikaragyozov Did you manage to work around this issue?

Hello. Yes, I'm simply not using the method that's opening the file with an EXCLUSIVE flag, i.e SftpClient.Create(string). As I initially stated, I've got no problems using UploadAsync or UploadFile to get the job done.

kikaragyozov avatar Feb 02 '24 06:02 kikaragyozov

Having done more research on this, I don't think it's the EXCLUSIVE flag. I believe that S3 doesn't like having the READ and WRITE flag set at the same time.

mitchej7 avatar Feb 12 '24 21:02 mitchej7