CloudFlare R2 storage configured, app still requiring AWS info #167

czottmann · 2025-01-24T13:51:30Z

czottmann
Jan 24, 2025

Hi,

I've set up a CloudFlare R2 bucket and set all the CF_ keys in .env. Unfortunately, uploading artifacts etc. doesn't work, as there seems to be a hardcoded (?) requirement for AWS.

For the record, my CF_REGION is weur (tried with other regions, no dice).

Here's the log:

E, [2025-01-24T13:38:01.390308 #21] ERROR -- : [05939257-7a18-4045-a579-b957ec45db5d] No region was provided. Configure the `:region` option or export the region name to ENV['AWS_REGION']
E, [2025-01-24T13:38:01.390404 #21] ERROR -- : [05939257-7a18-4045-a579-b957ec45db5d] /usr/local/bundle/ruby/3.3.0/gems/aws-sdk-s3-1.113.0/lib/aws-sdk-s3/plugins/s3_signer.rb:23:in `block in <class:S3Signer>'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/configuration.rb:72:in `call'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/configuration.rb:219:in `block in resolve_defaults'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/configuration.rb:59:in `each'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/configuration.rb:59:in `each'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/configuration.rb:218:in `resolve_defaults'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/configuration.rb:211:in `value_at'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/configuration.rb:191:in `block in resolve'
/usr/local/lib/ruby/3.3.0/set.rb:501:in `each_key'
/usr/local/lib/ruby/3.3.0/set.rb:501:in `each'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/configuration.rb:191:in `resolve'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/configuration.rb:179:in `apply_defaults'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/configuration.rb:152:in `build!'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/base.rb:65:in `build_config'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/base.rb:22:in `initialize'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-s3-1.113.0/lib/aws-sdk-s3/client.rb:435:in `initialize'
/usr/local/bundle/ruby/3.3.0/gems/aws-sdk-core-3.130.0/lib/seahorse/client/base.rb:102:in `new'
/app/app/models/release_artifact.rb:469:in `client'
/app/app/models/release_artifact.rb:464:in `presigner'
/app/app/models/release_artifact.rb:529:in `upload!'
/app/app/controllers/api/v1/release_artifacts_controller.rb:107:in `create'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_controller/metal/basic_implicit_render.rb:8:in `send_action'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/abstract_controller/base.rb:226:in `process_action'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_controller/metal/rendering.rb:193:in `process_action'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/abstract_controller/callbacks.rb:261:in `block in process_action'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/callbacks.rb:121:in `block in run_callbacks'
/app/app/controllers/concerns/default_headers.rb:17:in `add_default_headers'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/callbacks.rb:130:in `block in run_callbacks'
/app/app/controllers/application_controller.rb:394:in `rescue_from_exceptions'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/callbacks.rb:130:in `block in run_callbacks'
/usr/local/bundle/ruby/3.3.0/gems/request_migrations-1.1.1/lib/request_migrations/controller.rb:71:in `block in apply_migrations!'
/usr/local/bundle/ruby/3.3.0/gems/request_migrations-1.1.1/lib/request_migrations/controller.rb:24:in `migrate!'
/usr/local/bundle/ruby/3.3.0/gems/request_migrations-1.1.1/lib/request_migrations/controller.rb:71:in `apply_migrations!'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/callbacks.rb:130:in `block in run_callbacks'
/app/app/controllers/concerns/signature_headers.rb:28:in `add_signature_headers'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/callbacks.rb:130:in `block in run_callbacks'
/app/app/controllers/concerns/request_counter.rb:14:in `count_request!'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/callbacks.rb:130:in `block in run_callbacks'
/app/app/controllers/concerns/request_logger.rb:59:in `log_request!'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/callbacks.rb:130:in `block in run_callbacks'
/usr/local/bundle/ruby/3.3.0/gems/sentry-rails-5.16.1/lib/sentry/rails/controller_transaction.rb:28:in `block in sentry_around_action'
/usr/local/bundle/ruby/3.3.0/gems/sentry-ruby-5.16.1/lib/sentry/hub.rb:102:in `with_child_span'
/usr/local/bundle/ruby/3.3.0/gems/sentry-ruby-5.16.1/lib/sentry-ruby.rb:478:in `with_child_span'
/usr/local/bundle/ruby/3.3.0/gems/sentry-rails-5.16.1/lib/sentry/rails/controller_transaction.rb:14:in `sentry_around_action'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/callbacks.rb:130:in `block in run_callbacks'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/callbacks.rb:141:in `run_callbacks'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/abstract_controller/callbacks.rb:260:in `process_action'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_controller/metal/rescue.rb:27:in `process_action'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_controller/metal/instrumentation.rb:77:in `block in process_action'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/notifications.rb:210:in `block in instrument'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/notifications/instrumenter.rb:58:in `instrument'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/notifications.rb:210:in `instrument'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_controller/metal/instrumentation.rb:76:in `process_action'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_controller/metal/params_wrapper.rb:259:in `process_action'
/usr/local/bundle/ruby/3.3.0/gems/activerecord-7.2.2/lib/active_record/railties/controller_runtime.rb:39:in `process_action'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/abstract_controller/base.rb:163:in `process'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_controller/metal.rb:252:in `dispatch'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_controller/metal.rb:335:in `dispatch'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/routing/route_set.rb:67:in `dispatch'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/routing/route_set.rb:50:in `serve'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/routing/mapper.rb:32:in `block in <class:Constraints>'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/routing/mapper.rb:62:in `serve'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/journey/router.rb:53:in `block in serve'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/journey/router.rb:133:in `block in find_routes'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/journey/router.rb:126:in `each'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/journey/router.rb:126:in `find_routes'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/journey/router.rb:34:in `serve'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/routing/route_set.rb:896:in `call'
/app/lib/keygen/middleware.rb:16:in `call'
/usr/local/bundle/ruby/3.3.0/gems/rack-attack-6.6.0/lib/rack/attack.rb:127:in `call'
/app/lib/keygen/middleware.rb:252:in `call'
/usr/local/bundle/ruby/3.3.0/gems/rack-2.2.8.1/lib/rack/head.rb:12:in `call'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/middleware/callbacks.rb:31:in `block in call'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/callbacks.rb:101:in `run_callbacks'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/middleware/callbacks.rb:30:in `call'
/usr/local/bundle/ruby/3.3.0/gems/sentry-rails-5.16.1/lib/sentry/rails/rescued_exception_interceptor.rb:12:in `call'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/middleware/debug_exceptions.rb:31:in `call'
/usr/local/bundle/ruby/3.3.0/gems/sentry-ruby-5.16.1/lib/sentry/rack/capture_exceptions.rb:28:in `block (2 levels) in call'
/usr/local/bundle/ruby/3.3.0/gems/sentry-ruby-5.16.1/lib/sentry/hub.rb:251:in `with_session_tracking'
/usr/local/bundle/ruby/3.3.0/gems/sentry-ruby-5.16.1/lib/sentry-ruby.rb:391:in `with_session_tracking'
/usr/local/bundle/ruby/3.3.0/gems/sentry-ruby-5.16.1/lib/sentry/rack/capture_exceptions.rb:19:in `block in call'
/usr/local/bundle/ruby/3.3.0/gems/sentry-ruby-5.16.1/lib/sentry/hub.rb:59:in `with_scope'
/usr/local/bundle/ruby/3.3.0/gems/sentry-ruby-5.16.1/lib/sentry-ruby.rb:371:in `with_scope'
/usr/local/bundle/ruby/3.3.0/gems/sentry-ruby-5.16.1/lib/sentry/rack/capture_exceptions.rb:18:in `call'
/usr/local/bundle/ruby/3.3.0/gems/lograge-0.12.0/lib/lograge/rails_ext/rack/logger.rb:18:in `call_app'
/usr/local/bundle/ruby/3.3.0/gems/railties-7.2.2/lib/rails/rack/logger.rb:29:in `call'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/middleware/remote_ip.rb:96:in `call'
/usr/local/bundle/ruby/3.3.0/gems/request_store-1.5.1/lib/request_store/middleware.rb:19:in `call'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/middleware/request_id.rb:33:in `call'
/usr/local/bundle/ruby/3.3.0/gems/judoscale-ruby-1.5.4/lib/judoscale/request_middleware.rb:41:in `call'
/usr/local/bundle/ruby/3.3.0/gems/activesupport-7.2.2/lib/active_support/cache/strategy/local_cache_middleware.rb:29:in `call'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/middleware/executor.rb:16:in `call'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/middleware/ssl.rb:82:in `call'
/usr/local/bundle/ruby/3.3.0/gems/actionpack-7.2.2/lib/action_dispatch/middleware/host_authorization.rb:143:in `call'
/app/lib/keygen/middleware.rb:275:in `call'
/app/lib/keygen/middleware.rb:16:in `call'
/usr/local/bundle/ruby/3.3.0/gems/rack-cors-1.1.1/lib/rack/cors.rb:100:in `call'
/usr/local/bundle/ruby/3.3.0/gems/rack-timeout-0.6.0/lib/rack/timeout/core.rb:151:in `block in call'
/usr/local/bundle/ruby/3.3.0/gems/rack-timeout-0.6.0/lib/rack/timeout/support/timeout.rb:19:in `timeout'
/usr/local/bundle/ruby/3.3.0/gems/rack-timeout-0.6.0/lib/rack/timeout/core.rb:150:in `call'
/usr/local/bundle/ruby/3.3.0/gems/railties-7.2.2/lib/rails/engine.rb:535:in `call'
/usr/local/bundle/ruby/3.3.0/gems/puma-6.4.3/lib/puma/configuration.rb:272:in `call'
/usr/local/bundle/ruby/3.3.0/gems/puma-6.4.3/lib/puma/request.rb:100:in `block in handle_request'
/usr/local/bundle/ruby/3.3.0/gems/puma-6.4.3/lib/puma/thread_pool.rb:378:in `with_force_shutdown'
/usr/local/bundle/ruby/3.3.0/gems/puma-6.4.3/lib/puma/request.rb:99:in `handle_request'
/usr/local/bundle/ruby/3.3.0/gems/puma-6.4.3/lib/puma/server.rb:464:in `process_client'
/usr/local/bundle/ruby/3.3.0/gems/puma-6.4.3/lib/puma/server.rb:245:in `block in run'
/usr/local/bundle/ruby/3.3.0/gems/puma-6.4.3/lib/puma/thread_pool.rb:155:in `block in spawn_thread'

Any ideas? TIA!

ezekg · 2025-01-24T15:03:18Z

ezekg
Jan 24, 2025
Maintainer

Is the account's storage backend set to R2 or S3? You can check via a console:

Account.sole.backend

It should be set to R2 if you're wanting to use Cloudflare R2.

7 replies

czottmann Jan 24, 2025
Author

It isn't, I'm afraid. Still seeing (different) AWS errors.

web-1       | I, [2025-01-24T18:40:05.708135 #27]  INFO -- : [427c155f-8b11-48ad-a609-73bcfc5c3dc8] method=POST path=/v1/artifacts format=jsonapi controller=Api::V1::ReleaseArtifactsController action=create status=307 duration=457.60 view=1.69 db=25.38 host= […] user_agent=keygen/1.5 sdk/2.9.0 go/go1.23.2 darwin/arm64 cli/2.9.2 origin=N/A time=2025-01-24 18:40:05 UTC code=N/A encoded_response=N/A req_exceeded=false req_count=360 req_limit=N/A rate_limited=false rate_reset= rate_window=0 rate_count=0 rate_limit=0 rate_remaining=0
worker-1    | W, [2025-01-24T18:40:05.748048 #1]  WARN -- : Scoped order is ignored, it's forced to be batch order.
worker-1    | 2025-01-24T18:40:05.770Z pid=1 tid=3cmt class=CreateWebhookEventsWorker jid=7c37bb8b50064495a1a9dcff elapsed=0.069 INFO: done
worker-1    | 2025-01-24T18:40:05.773Z pid=1 tid=3cm9 class=EventNotificationWorker jid=66bbb6289a7a03fe2ede4690 elapsed=0.082 INFO: done
worker-1    | 2025-01-24T18:40:05.776Z pid=1 tid=3clp class=RecordMetricWorker jid=251caf676ffb99083573da34 elapsed=0.084 INFO: done
worker-1    | W, [2025-01-24T18:40:05.850366 #1]  WARN -- : [workers.wait-for-artifact-upload-worker] Error: Aws::Waiters::Errors::UnexpectedError - stopped waiting due to an unexpected error: Aws::S3::Errors::Forbidden

ezekg Jan 24, 2025
Maintainer

This seems like an issue with your R2 secret not having permission to wait on the uploaded artifact, not with Keygen.

ezekg Jan 24, 2025
Maintainer

The error mentions AWS because it's using the AWS S3 client library, which is compatible with other S3-compatible backends like R2, i.e. there is no R2 client library, because the S3 library is compatible, so all S3-compatible backends use the same client.

czottmann Jan 24, 2025
Author

This seems like an issue with your R2 secret not having permission to wait on the uploaded artifact, not with Keygen

That is configurable w/ R2‽ The API token is of type "Object Read & Write" (allows the ability to read, write, and list objects in specific buckets), and even if I make it an Admin token, nothing changes. The bucket is a Standard EU jurisdiction bucket. Not sure what else to change… 🤷🏻‍♂️

Thanks for your help, BTW, appreciate it.

PS: config/initializers/r2.rb puts everything in https://#{CF_ACCOUNT_ID}.r2.cloudflarestorage.com which is wrong for buckets w/ EU jurisdiction, as specified at https://developers.cloudflare.com/r2/api/s3/tokens/:

Jurisdictional buckets can only be accessed via the corresponding jurisdictional endpoint. Most S3 clients will not let you configure multiple endpoints, so you'll generally have to initialize one client per jurisdiction.

ezekg Jan 24, 2025
Maintainer

Try setting CF_ACCOUNT_ID to whatever your account ID is + .eu. I don't think it's used anywhere except to build that URL.

Open to a PR that fixes this for EU users. Maybe a CF_ENDPOINT env var would work like keygen-sh/keygen-api#895?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Keygen

CloudFlare R2 storage configured, app still requiring AWS info #167

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 7 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Keygen

CloudFlare R2 storage configured, app still requiring AWS info #167

Uh oh!

czottmann Jan 24, 2025

Replies: 1 comment · 7 replies

Uh oh!

ezekg Jan 24, 2025 Maintainer

Uh oh!

czottmann Jan 24, 2025 Author

Uh oh!

ezekg Jan 24, 2025 Maintainer

Uh oh!

Uh oh!

ezekg Jan 24, 2025 Maintainer

Uh oh!

Uh oh!

czottmann Jan 24, 2025 Author

Uh oh!

ezekg Jan 24, 2025 Maintainer

czottmann
Jan 24, 2025

Replies: 1 comment 7 replies

ezekg
Jan 24, 2025
Maintainer

czottmann Jan 24, 2025
Author

ezekg Jan 24, 2025
Maintainer

ezekg Jan 24, 2025
Maintainer

czottmann Jan 24, 2025
Author

ezekg Jan 24, 2025
Maintainer