RuntimePermission accessDeclaredMembers when calling AmazonS3Client.doesBucketExist

[dadoonet]

Hey

Tested with 1.11.20. See elastic/elasticsearch#19594.

We are getting this exception when running under a Security Manager.

[2016-07-26 09:36:40,350][WARN ][repositories             ] [AUqzQAb] failed to create repository [s3][test_repo_s3_1]
java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "accessDeclaredMembers")
    at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
    at java.security.AccessController.checkPermission(AccessController.java:884)
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
    at java.lang.Class.checkMemberAccess(Class.java:2348)
    at java.lang.Class.getDeclaredConstructors(Class.java:2019)
    at com.fasterxml.jackson.databind.introspect.AnnotatedClass.resolveCreators(AnnotatedClass.java:338)
    at com.fasterxml.jackson.databind.introspect.AnnotatedClass.getStaticMethods(AnnotatedClass.java:245)
    at com.fasterxml.jackson.databind.introspect.BasicBeanDescription.getFactoryMethods(BasicBeanDescription.java:461)
    at com.fasterxml.jackson.databind.deser.BasicDeserializerFactory._addDeserializerFactoryMethods(BasicDeserializerFactory.java:670)
    at com.fasterxml.jackson.databind.deser.BasicDeserializerFactory._constructDefaultValueInstantiator(BasicDeserializerFactory.java:321)
    at com.fasterxml.jackson.databind.deser.BasicDeserializerFactory.findValueInstantiator(BasicDeserializerFactory.java:254)
    at com.fasterxml.jackson.databind.deser.BasicDeserializerFactory.createCollectionDeserializer(BasicDeserializerFactory.java:1027)
    at com.fasterxml.jackson.databind.deser.DeserializerCache._createDeserializer2(DeserializerCache.java:394)
    at com.fasterxml.jackson.databind.deser.DeserializerCache._createDeserializer(DeserializerCache.java:352)
    at com.fasterxml.jackson.databind.deser.DeserializerCache._createAndCache2(DeserializerCache.java:264)
    at com.fasterxml.jackson.databind.deser.DeserializerCache._createAndCacheValueDeserializer(DeserializerCache.java:244)
    at com.fasterxml.jackson.databind.deser.DeserializerCache.findValueDeserializer(DeserializerCache.java:142)
    at com.fasterxml.jackson.databind.DeserializationContext.findContextualValueDeserializer(DeserializationContext.java:428)
    at com.fasterxml.jackson.databind.deser.std.StdDeserializer.findDeserializer(StdDeserializer.java:947)
    at com.fasterxml.jackson.databind.deser.BeanDeserializerBase.resolve(BeanDeserializerBase.java:439)
    at com.fasterxml.jackson.databind.deser.DeserializerCache._createAndCache2(DeserializerCache.java:296)
    at com.fasterxml.jackson.databind.deser.DeserializerCache._createAndCacheValueDeserializer(DeserializerCache.java:244)
    at com.fasterxml.jackson.databind.deser.DeserializerCache.findValueDeserializer(DeserializerCache.java:142)
    at com.fasterxml.jackson.databind.DeserializationContext.findRootValueDeserializer(DeserializationContext.java:461)
    at com.fasterxml.jackson.databind.ObjectMapper._findRootDeserializer(ObjectMapper.java:3838)
    at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3732)
    at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2796)
    at com.amazonaws.partitions.PartitionsLoader.loadPartitionFromStream(PartitionsLoader.java:92)
    at com.amazonaws.partitions.PartitionsLoader.build(PartitionsLoader.java:84)
    at com.amazonaws.regions.RegionMetadataFactory.create(RegionMetadataFactory.java:30)
    at com.amazonaws.regions.RegionUtils.initialize(RegionUtils.java:66)
    at com.amazonaws.regions.RegionUtils.getRegionMetadata(RegionUtils.java:54)
    at com.amazonaws.regions.RegionUtils.getRegion(RegionUtils.java:107)
    at com.amazonaws.services.s3.AmazonS3Client.createSigner(AmazonS3Client.java:3288)
    at com.amazonaws.services.s3.AmazonS3Client.invoke(AmazonS3Client.java:3984)
    at com.amazonaws.services.s3.AmazonS3Client.headBucket(AmazonS3Client.java:1218)
    at com.amazonaws.services.s3.AmazonS3Client.doesBucketExist(AmazonS3Client.java:1175)

[shorea]

Which version of aws-java-sdk-core are you using? This should have been fixed in the latest version of the SDK.

[dadoonet]

1.11.20

[shorea]

Thanks, I'll take another look. Is this the only API call you're having issues with?

[shorea]

Okay I was able to reproduce this problem. I don't know if there is a fix for it though, Jackson relies heavily on the ability to access declared fields. Could you grant the SDK access to this permission in your security policy?

[shorea]

Closing issue. Feel free to reopen if workaround is not viable.