S3's check-path is not specific enough

[kennytm]

Please answer these questions before submitting your issue. Thanks!

1. What did you do?

1. dump some SQL files into s3://some-bucket/some-prefix/ on AWS S3.
2. create a role, give it the s3:ListBucket and s3:GetObject permission, conditioned with s3:prefix=some-prefix/.
3. run Lightning using that role

2. What did you expect to see?

successfully restored.

3. What did you see instead?

failed due to an unnecessary HeadBucket call:

tidb lightning encountered error:  create storage failed: Bucket some-bucket is not accessible: Forbidden: Forbidden
        status code: 403, request id: ..., host id: ...: [BR:ExternalStorage:ErrStorageInvalidConfig]invalid external storage config

4. What version of BR and TiDB/TiKV/PD are you using?

master

[kennytm]

Note: affects all users of br/pkg/storage, including BR itself (can workaround with --skip-check-path), TiCDC and Dumpling (both have SkipCheckPath hard-coded to false).

[handlerww]

Reproduce:

1. Create IAM policy, use this JSON, modify the content in Condition to your test subpath.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "s3:prefix": "subdir/*"
                }
            }
        }
    ]
}

You can refer to this article: https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/

2. Create a IAM role, attach the policy created before to this role

3. Set IAM role of EC2 to a certain role

[lonng]

@glorv Seems this bug had been fixed in pingcap/br#899, can we close this issue?

[glorv]

closed in favor of pingcap/dumpling#286 and https://github.com/pingcap/ticdc/pull/1890

[lance6716]

open since master didn't fix it

tidb/br/pkg/lightning/lightning.go

Line 294 in ac25e9f

s, err := storage.New(ctx, u, &storage.ExternalStorageOptions{})

tidb/br/pkg/storage/s3.go

Lines 287 to 292 in ac25e9f

	if !opts.SkipCheckPath {
	err = checkS3Bucket(c, &qs)
	if err != nil {
	return nil, errors.Annotatef(berrors.ErrStorageInvalidConfig, "Bucket %s is not accessible: %v", qs.Bucket, err)
	}
	}

[lance6716]

/assign @glorv