Object Locked (Governance) Bucket/Files - Cannot Remove

[cphaynes]

Hi all -

Created a bucket with Object Lock, using the Governance, option. I was testing an app and figured, through Storj’s description of the permissions, that I could then create a user with the BypassGovernance flag to remove any testing buckets/objects I was using.

Went through testing, etc., but the bucket and objects won’t delete. I’ve tried several times, creating new credentials, access grants, and API keys. Used the browser, s3cmd (which I found won’t work anyways with versioned bukets), and finally on Storj’s Uplink. When I go to delete the bucket - with a user that has permissions - I get:

uplink: permission denied (bucket: metaclient: Unauthorized API credentials)

I don’t understand what I’m missing here. The API key (again, tried several times) has permissions via the website’s description (i.e., the advanced → bypass flag is checked).

Any thoughts here?

Thank you.

[nerdatwork]

Remove object lock in governance mode

I’m aware this might be a bit of a silly situation. I signed up for the 30 day trial and figured I’d try the object lock feature. For some reason I picked 1 year as a retention with governance as mode. The reasoning being I could always bypass the object lock as per the description. Well. I’m unable to unlock the bucket or delete the files. Are my files held “hostage” for a year even if the trial runs out? Would be very nice if someone would be able to just delete my project and/or bucket

[Alexey]

Hello @cphaynes,
Welcome back!

Remove object lock in governance mode

You may also configure rclone with Storj S3 and use this method: rclone purge us1-gw-mt:my-locked-bucket --header "x-amz-bypass-governance-retention:true" However, it requires that you know the encryption phrase. The other method would be using uplink not older than Release v1.124.6 · storj/storj · GitHub uplink ls --encrypted --recursive --all-versions sj://locked-bucket/ -o json | jq '"uplink rm --encrypted --bypass-governance-retention --version-id " + .versionId + " sj://locked-bucket/" …

[cphaynes]

Alexey -

Came to say thank you for your response.

Your suggestion to download and try an older version of Uplink worked like a champ, first try. Amazing.

RClone did not work as I continually received an “API” not authorized error. I tried this method first (already had RC installed) using the same API credentials I’ve always been using, and had the same issue / response as the newest version of Uplink. Just noting this as a “FYI.”

Without trying to sound ignorant (i.e., I haven’t searched properly), is this governance issue a “bug” in Uplink that will be fixed, or is this something new that I need to be aware of for the future (i.e., I need to go about all of this differently moving forward)?

Again - thank you.

[Alexey]

@cphaynes

using the same API credentials I’ve always been using, and had the same issue

That’s a culprit. You need to use credentials with a specific permission, called BypassGovernanceRetention, which is not a part of default Full permissions, so you need to use a special S3 credentials, created in an Advance mode, where this permission is available.
I updated my response to give you a hint.

[cphaynes]

I guess I should have clarified, apologies.

I should have said that I created new keys with those permissions you mentioned to test Object Lock on a bucket. Nothing worked, at all, except the older version of Uplink.

[littleskunk]

The new uplink version has a flag to bypass governance lock. Uplink will not silently ignore governance locks. You have to add that flag.

[Alexey]

Thank you for the feedback. I tested locally and with that permissions the rclone purge with that header worked. But you need to use Storj S3 integration, not native and need to know the encryption phrase.
Maybe something else was wrong.

I’m glad that the new version of uplink CLI made it, thank you for the confirmation!