dvc import from s3 remote with version-aware not working

[alhaal]

We cannot import data from s3 using dvc import. dvc push is working without any probnlem.

dvc import
dvc import git_url data
ERROR: unexpected error - Forbidden: An error occurred (403) when calling the HeadObject operation: Forbidden

dvc onfig
[core]
remote = s3remote
autostage = true

['remote "s3remote"']
url = s3://bucketname/dvc
version_aware = true
worktree = true
region = eu-west-1

aws cli is working:
aws s3api head-object --bucket bucketname --key dvc/data/folder1/filename1.txt works and gives an output

DVC version: 3.51.2 (pip)
Platform: Python 3.10.9 on Windows-10-10.0.19045-SP0
Subprojects:
dvc_data = 3.15.1
dvc_objects = 5.1.0
dvc_render = 1.0.2
dvc_task = 0.4.0
scmrepo = 3.3.6
Supports:
http (aiohttp = 3.9.5, aiohttp-retry = 2.8.3),
https (aiohttp = 3.9.5, aiohttp-retry = 2.8.3),
s3 (s3fs = 2024.6.1, boto3 = 1.34.131)
Config:
Global:
System:
Cache types: https://error.dvc.org/no-dvc-cache
Caches: local
Remotes: s3, s3
Workspace directory: NTFS on D:
Repo: dvc, git
Repo.site_cache_dir:

[shcheklein]

@alhaal how do you setup AWS credentials on the machine?

In the repo that your are importing your data into, do you have a different bucket, storage, set of credentials?

[alhaal]

@shcheklein thank you for your answer, we are importing data into a differnt repo which uses the same bucket and using the same credentials. Do the version-aware functionality requires special permissions? the s3:HeadObject action is already configured in the bucket policy. we are able to import data if we do not use the version-aware option.

[alhaal]

like like AWS_SECRET=abc dvc import ...? or export AWS_SECRET ...`?

set AWS_ACCESS_KEY_ID=...
set AWS_SECRET_ACCESS_KEY=...
set AWS_SESSION_TOKEN=...
dvc import ...

[shcheklein]

hmm, okay, I've tried it on my machine (Mac, I don't have win at the moment) - it works fine with:

export ...
dvc import ... (version aware repo here)

can't immediately point to the source of issue ... can you run it with -v, let's see if we can get some details

[shcheklein]

okay, as an experiment, can you try to do this.

in the same window / session / terminal where you set these credentials - do a fresh git clone that registry, cd into it, and do dvc pull <path> of the data file. Does it work for you?

[alhaal]

okay, as an experiment, can you try to do this.

in the same window / session / terminal where you set these credentials - do a fresh git clone that registry, cd into it, and do dvc pull <path> of the data file. Does it work for you?

dvc pull data

same error:
ERROR: unexpected error - Forbidden: An error occurred (403) when calling the HeadObject operation: Forbidden

[shcheklein]

okay, so, it's not about import at least ...

• run dvc pull -v - it might print the actual object that it is failing to download. Try then aws cli on it.
• check the .dvc/config please, run dvc config --list --show-origin to see the values, make sure that it's exactly the same remote and you have access to it

do the same in the origin repo (to the one you were trying to import your data to) and compare please.