Does vector need read permissions for s3 sink ?

[mehrdad-khojastefar]

Hi, I have a vector instance that has an s3 sink, the s3 key associated to this vector instance only has write permissions.
Today I've found out that I am getting 403 from my s3 and by checking my s3 logs I've noticed that vector had tried to read something from s3.
The situation that this happened was not normal because alongside my s3 sink I have an elasticsearch sink and the elasticsearch was not responding at the moment of vector tried to read from s3. So I'm suspicious that maybe there is some fault-tolerance mechanism that needs read access.
I've reviewed the code for s3 sinks but have not found anything.

[jszwedko]

Hey!

The aws_s3 uses ListBucket for the health check. We intended to publish the IAM requirements on the website, but, for now, you can see them described here:

vector/website/cue/reference/components/sinks/aws_s3.cue

Lines 201 to 218 in 0a2dc2b

	permissions: iam: [
	{
	platform: "aws"
	_service: "s3"
	_docs_tag: "AmazonS3"
	_url_fragment: "API"
	policies: [
	{
	_action: "ListBucket"
	required_for: ["healthcheck"]
	},
	{
	_action: "PutObject"
	},
	]
	},
	]

[mehrdad-khojastefar]

Thanks, and how does it perform the health check ? What does it check ?

[jszwedko]

It executes a ListBucket API call.