Skip to content

Fix S3 storage key limits and permission guidance - #2002

Merged
tconley1428 merged 2 commits into
temporalio:mainfrom
diwu-sf:codex/fix-s3-storage-names-permissions
Oct 28, 2026
Merged

tconley1428 merged 2 commits into
temporalio:mainfrom
diwu-sf:codex/fix-s3-storage-names-permissions

Conversation

@diwu-sf

@diwu-sf diwu-sf commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

External payload uploads can fail repeatedly when escaped workflow or activity IDs produce S3 keys longer than 1,024 bytes. Fall back to a namespace-scoped hash key in that case, and write /ns/null for empty namespaces. Existing saved references remain readable.

Correct the aioboto3 permission example: uploads check object existence first, so writers need s3:GetObject and s3:ListBucket as well as s3:PutObject. Access-denied responses continue to fail rather than being treated as missing objects.

Includes a changelog fragment and tests for name-length boundaries, escaped names, namespace separation, old references, and access-denied responses. Related naming feedback: #1980 (comment).

Validation

  • poe test -s -n 0 tests/contrib/aws/s3driver: 86 passed on Python 3.12 and 3.14, including workflow/activity tests against the local S3 test server.
  • Eight new naming cases failed before the fix.
  • poe lint passed.

@diwu-sf
diwu-sf requested a review from a team as a code owner October 22, 2026 06:23
@tconley1428
tconley1428 merged commit c34e6b7 into temporalio:main Oct 28, 2026
34 of 36 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants