How do you determine your permissions in AWS S3 through the Java SDK?

Question

I know you can try to read the ACLs or Bucket Policies through the Java SDK, but is there any easy way to just check if you have read and/or write permissions to a bucket and/or its contents? I don't see any "haveReadPermissions()" method or anything in the AmazonS3 class, but maybe I'm missing something? I find it hard to believe there's no easy way to check permissions.

Answer 1

I think the answer is that there's no fool-proof way to do this, at least not at this time. There are a couple other methods you can use to try to get around this. I originally tried to use the getBucketLocation() method to determine if my given user had read access to the bucket, but it turns out you must be the owner of the bucket to use this method... so that didn't work.

For read access, there is another hack you can use. Just use something along the lines of getObject(bucketName, UUID.randomUUID().toString()) - this will throw an exception because you are trying to fetch a key that doesn't exist. Catch the AmazonServiceException (or AmazonS3Exception) and check that the e.getErrorCode() equals "NoSuchKey". If this is the case, then you have read access to the bucket. If it's any other error code, then you don't have access, or the bucket doesn't exist, etc (it could be any number of things). Make sure you explicitly check the ErrorCode not the StatusCode, because you will also get a 404 StatusCode if the bucket doesn't exist (which is the same StatusCode you get when the key doesn't exist). Here's the complete list of S3 error/status codes: http://docs.aws.amazon.com/AmazonS3/latest/API/ErrorResponses.html

For write access, it's not as simple. The best way is to actually write a small test file to the bucket (and then maybe try to delete it). Besides that, if you want to check for more generic permissions, using a method like PutObjectAcl will determine if your user has "s3:Put*" permissions (you can set the ACL to the exact same as the current ACL by reading it first and then using that to set it).