Skip to content

Fix S3 storage key limits and permission guidance - #2002

Open
diwu-sf wants to merge 1 commit into
temporalio:mainfrom
diwu-sf:codex/fix-s3-storage-names-permissions
Open

diwu-sf wants to merge 1 commit into
temporalio:mainfrom
diwu-sf:codex/fix-s3-storage-names-permissions

Conversation

@diwu-sf

@diwu-sf diwu-sf commented Oct 22, 2026

Copy link
Copy Markdown

External payload uploads can fail repeatedly when escaped workflow or activity IDs produce S3 keys longer than 1,024 bytes. Fall back to a namespace-scoped hash key in that case, and write /ns/null for empty namespaces. Existing saved references remain readable.

Correct the aioboto3 permission example: uploads check object existence first, so writers need s3:GetObject and s3:ListBucket as well as s3:PutObject. Access-denied responses continue to fail rather than being treated as missing objects.

Includes a changelog fragment and tests for name-length boundaries, escaped names, namespace separation, old references, and access-denied responses. Related naming feedback: #1980 (comment).

Validation

  • poe test -s -n 0 tests/contrib/aws/s3driver: 86 passed on Python 3.12 and 3.14, including workflow/activity tests against the local S3 test server.
  • Eight new naming cases failed before the fix.
  • poe lint passed.

@diwu-sf
diwu-sf requested a review from a team as a code owner October 22, 2026 06:23

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant