An error occurred (403) when calling the HeadBucket operation: Forbidden

[Eric-zch]

Hi there,

I’m experiencing a WAL archiving issue when attempting to archive WAL files to a NooBaa S3 bucket.

First I created a cluster using a YAML file and configured the barmanObjectStore section as follows:

apiVersion: postgresql.k8s.enterprisedb.io/v1
kind: Cluster
metadata:
  name: smps
  namespace: ibas-smps
spec:
  backup:
    target: prefer-standby
    barmanObjectStore:
      data:
        compression: gzip
      destinationPath: s3://s3pgbackupsbucket/ibas/ibas-smps/repo
      endpointURL: https://192.168.25.55:6443
      endpointCA:
        key: ca.crt
        name: s3-ca-secret
      s3Credentials:
        accessKeyId:
          key: ACCESS_KEY_ID
          name: aws-creds
        secretAccessKey:
          key: ACCESS_SECRET_KEY
          name: aws-creds
      wal:
        compression: gzip
        encryption: AES256
        maxParallel: 8
...

But WAL archiving is failing with the following errors:

{"level":"info","ts":"2026-01-04T12:31:53.592515738Z","logger":"barman-cloud-check-wal-archive","msg":"2026-01-04 12:31:53,592 [736] ERROR: Barman cloud WAL archive check exception: An error occurred (403) when calling the HeadBucket operation: Forbidden","pipe":"stderr","logging_pod":"smps-1"}
{"level":"error","ts":"2026-01-04T12:31:53.652754173Z","logger":"wal-archive","msg":"Error invoking barman-cloud-check-wal-archive","logging_pod":"smps-1","options":["--endpoint-url","https://192.168.25.55:6443","--cloud-provider","aws-s3","s3://s3pgbackupsbucket/ibas/ibas-smps/repo","smps"],"exitCode":-1,"error":"exit status 4","stacktrace":"github.com/cloudnative-pg/machinery/pkg/log.(*logger).Error\n\tpkg/mod/github.com/cloudnative-pg/machinery@v0.3.1/pkg/log/log.go:125\ngithub.com/cloudnative-pg/barman-cloud/pkg/walarchive.(*BarmanArchiver).CheckWalArchiveDestination\n\tpkg/mod/github.com/cloudnative-pg/barman-cloud@v0.3.3/pkg/walarchive/cmd.go:175\ngithub.com/cloudnative-pg/barman-cloud/pkg/archiver.(*WALArchiver).CheckWalArchiveDestination\n\tpkg/mod/github.com/cloudnative-pg/barman-cloud@v0.3.3/pkg/archiver/archiver.go:131\ngithub.com/EnterpriseDB/cloud-native-postgres/pkg/management/postgres/archiver.checkWalArchive\n\tpkg/management/postgres/archiver/archiver.go:345\ngithub.com/EnterpriseDB/cloud-native-postgres/pkg/management/postgres/archiver.internalRun\n\tpkg/management/postgres/archiver/archiver.go:210\ngithub.com/EnterpriseDB/cloud-native-postgres/pkg/management/postgres/archiver.Run\n\tpkg/management/postgres/archiver/archiver.go:155\ngithub.com/EnterpriseDB/cloud-native-postgres/internal/cmd/manager/walarchive.NewCmd.func1\n\tinternal/cmd/manager/walarchive/cmd.go:68\ngithub.com/spf13/cobra.(*Command).execute\n\tpkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1015\ngithub.com/spf13/cobra.(*Command).ExecuteC\n\tpkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1148\ngithub.com/spf13/cobra.(*Command).Execute\n\tpkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1071\nmain.main\n\tcmd/manager/main.go:75\nruntime.main\n\t/opt/hostedtoolcache/go/1.25.5/x64/src/runtime/proc.go:285"}
{"level":"error","ts":"2026-01-04T12:31:53.652965811Z","logger":"wal-archive","msg":"while barman-cloud-check-wal-archive","logging_pod":"smps-1","error":"unexpected failure invoking barman-cloud-wal-archive: exit status 4","stacktrace":"github.com/cloudnative-pg/machinery/pkg/log.(*logger).Error\n\tpkg/mod/github.com/cloudnative-pg/machinery@v0.3.1/pkg/log/log.go:125\ngithub.com/EnterpriseDB/cloud-native-postgres/pkg/management/postgres/archiver.checkWalArchive\n\tpkg/management/postgres/archiver/archiver.go:346\ngithub.com/EnterpriseDB/cloud-native-postgres/pkg/management/postgres/archiver.internalRun\n\tpkg/management/postgres/archiver/archiver.go:210\ngithub.com/EnterpriseDB/cloud-native-postgres/pkg/management/postgres/archiver.Run\n\tpkg/management/postgres/archiver/archiver.go:155\ngithub.com/EnterpriseDB/cloud-native-postgres/internal/cmd/manager/walarchive.NewCmd.func1\n\tinternal/cmd/manager/walarchive/cmd.go:68\ngithub.com/spf13/cobra.(*Command).execute\n\tpkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1015\ngithub.com/spf13/cobra.(*Command).ExecuteC\n\tpkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1148\ngithub.com/spf13/cobra.(*Command).Execute\n\tpkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1071\nmain.main\n\tcmd/manager/main.go:75\nruntime.main\n\t/opt/hostedtoolcache/go/1.25.5/x64/src/runtime/proc.go:285"}
{"level":"error","ts":"2026-01-04T12:31:53.653035844Z","logger":"wal-archive","msg":"failed to run wal-archive command","logging_pod":"smps-1","error":"unexpected failure invoking barman-cloud-wal-archive: exit status 4","stacktrace":"github.com/cloudnative-pg/machinery/pkg/log.(*logger).Error\n\tpkg/mod/github.com/cloudnative-pg/machinery@v0.3.1/pkg/log/log.go:125\ngithub.com/EnterpriseDB/cloud-native-postgres/internal/cmd/manager/walarchive.NewCmd.func1\n\tinternal/cmd/manager/walarchive/cmd.go:73\ngithub.com/spf13/cobra.(*Command).execute\n\tpkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1015\ngithub.com/spf13/cobra.(*Command).ExecuteC\n\tpkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1148\ngithub.com/spf13/cobra.(*Command).Execute\n\tpkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1071\nmain.main\n\tcmd/manager/main.go:75\nruntime.main\n\t/opt/hostedtoolcache/go/1.25.5/x64/src/runtime/proc.go:285"}
{"level":"info","ts":"2026-01-04T12:31:53.655453753Z","logger":"postgres","msg":"record","logging_pod":"smps-1","record":{"log_time":"2026-01-04 13:31:53.655 CET","process_id":"31","session_id":"695a5cf0.1f","session_line_num":"19","session_start_time":"2026-01-04 13:28:32 CET","transaction_id":"0","error_severity":"LOG","sql_state_code":"00000","message":"archive command failed with exit code 1","detail":"The failed archive command was: /controller/manager wal-archive --log-destination /controller/log/postgres.json pg_wal/000000010000000000000001","backend_type":"archiver","query_id":"0"}}
{"level":"info","ts":"2026-01-04T12:31:53.655494111Z","logger":"postgres","msg":"record","logging_pod":"smps-1","record":{"log_time":"2026-01-04 13:31:53.655 CET","process_id":"31","session_id":"695a5cf0.1f","session_line_num":"20","session_start_time":"2026-01-04 13:28:32 CET","transaction_id":"0","error_severity":"WARNING","sql_state_code":"01000","message":"archiving write-ahead log file \"000000010000000000000001\" failed too many times, will try again later","backend_type":"archiver","query_id":"0"}}

The S3 user has all the necessary permissions:

s3:ListBucket
s3:GetBucketLocation
s3:HeadBucket
s3:PutObject
s3:GetObject

I've checked the permissions:

[root@s3-9000-ibas certificates]# export AWS_CA_BUNDLE=/root/certificates/s3-vip-ibas.crt
[root@s3-9000-ibas certificates]# aws --endpoint-url https://192.168.25.55:6443 s3 ls s3://s3pgbackupsbucket
                           PRE ibas/
[root@s3-9000-ibas certificates]# 
[root@s3-9000-ibas certificates]# aws s3api get-bucket-location --bucket s3pgbackupsbucket --endpoint-url https://192.168.25.55:6443
{
    "LocationConstraint": null
}
[root@s3-9000-ibas certificates]# 
[root@s3-9000-ibas certificates]# aws s3api head-bucket --bucket s3pgbackupsbucket --endpoint-url https://192.168.25.55:6443
[root@s3-9000-ibas certificates]# echo $?
0
[root@s3-9000-ibas certificates]# 
[root@s3-9000-ibas certificates]# echo "test" > test.txt
[root@s3-9000-ibas certificates]# aws s3 cp test.txt s3://s3pgbackupsbucket/test.txt --endpoint-url https://192.168.25.55:6443
upload: ./test.txt to s3://s3pgbackupsbucket/test.txt          
[root@s3-9000-ibas certificates]# 
[root@s3-9000-ibas certificates]# aws s3 cp s3://s3pgbackupsbucket/test.txt ./downloaded.txt --endpoint-url https://192.168.25.55:6443
download: s3://s3pgbackupsbucket/test.txt to ./downloaded.txt   
[root@s3-9000-ibas certificates]# diff test.txt downloaded.txt 
[root@s3-9000-ibas certificates]# 
[root@s3-9000-ibas certificates]# aws s3 rm s3://s3pgbackupsbucket/test.txt --endpoint-url https://192.168.25.55:6443
delete: s3://s3pgbackupsbucket/test.txt
[root@s3-9000-ibas certificates]# ls -l test.txt
-rw-r--r--. 1 root root 5 Jan  7 03:00 test.txt
[root@s3-9000-ibas certificates]# 
[root@s3-9000-ibas certificates]# rm -rf test.txt downloaded.txt 
[root@s3-9000-ibas certificates]# 
[root@s3-9000-ibas ~]# systemctl --type=service | grep -iE 'minio|rgw|noobaa|object|s3'
  noobaa.service                     loaded active running The NooBaa service.
[root@s3-9000-ibas ~]# 
[root@s3-9000-ibas ~]# ss -tulnp | grep -E '9000|9001|7480|8080|443'
tcp   LISTEN 0      511                     *:47443            *:*    users:(("java",pid=8394,fd=135))                         
tcp   LISTEN 0      511                     *:6443             *:*    users:(("noobaa",pid=13055,fd=20))                       
tcp   LISTEN 0      511                     *:9443             *:*    users:(("noobaa",pid=13055,fd=24))                       
[root@s3-9000-ibas ~]# 

pgBackRest has no problems using this same bucket configuration.

Please advise if there’s anything wrong with my configuration or if a workaround exists.

Thank you.

[martinmarques]

It would be great if you could run this with -v so we get debug messages from barman-cloud-wal-archive (I don't know how to do that with CNPG).

[martinmarques]

Also, a recommendation, when you get an error like this, and you have control over the server side, which seems to be the case from the output shared, it's good to check logs from the server, as you'll very likely have information regarding why the permission was denied

[Eric-zch]

Hi @martinmarques
The EDB Postgres cluster is deployed on OpenShift, and all log output is coming from the pod. There are no other logs available from the server side.

[martinmarques]

Can you run the barman-cloud-wal-archive -v so you get verbose output? There is a hint in the code path that might shed some light on the missing permission.

[Eric-zch]

@martinmarques
Sure.
Below is the verbose output.

bash-4.4$ barman-cloud-wal-archive \
>   -vv \
>   --cloud-provider aws-s3 \
>   --endpoint-url https://192.168.25.55:6443 \
>   s3://s3pgbackupsbucket/ibas/ibas-smps/repo \
>   smps \
>   /var/lib/postgresql/data/pgdata/pg_wal/000000010000000000000001
2026-01-09 09:55:57,546 [267895] DEBUG: Changing event name from creating-client-class.iot-data to creating-client-class.iot-data-plane
2026-01-09 09:55:57,549 [267895] DEBUG: Changing event name from before-call.apigateway to before-call.api-gateway
2026-01-09 09:55:57,550 [267895] DEBUG: Changing event name from request-created.machinelearning.Predict to request-created.machine-learning.Predict
2026-01-09 09:55:57,552 [267895] DEBUG: Changing event name from before-parameter-build.autoscaling.CreateLaunchConfiguration to before-parameter-build.auto-scaling.CreateLaunchConfiguration
2026-01-09 09:55:57,552 [267895] DEBUG: Changing event name from before-parameter-build.route53 to before-parameter-build.route-53
2026-01-09 09:55:57,553 [267895] DEBUG: Changing event name from request-created.cloudsearchdomain.Search to request-created.cloudsearch-domain.Search
2026-01-09 09:55:57,554 [267895] DEBUG: Changing event name from docs.*.autoscaling.CreateLaunchConfiguration.complete-section to docs.*.auto-scaling.CreateLaunchConfiguration.complete-section
2026-01-09 09:55:57,558 [267895] DEBUG: Changing event name from before-parameter-build.logs.CreateExportTask to before-parameter-build.cloudwatch-logs.CreateExportTask
2026-01-09 09:55:57,558 [267895] DEBUG: Changing event name from docs.*.logs.CreateExportTask.complete-section to docs.*.cloudwatch-logs.CreateExportTask.complete-section
2026-01-09 09:55:57,558 [267895] DEBUG: Changing event name from before-parameter-build.cloudsearchdomain.Search to before-parameter-build.cloudsearch-domain.Search
2026-01-09 09:55:57,558 [267895] DEBUG: Changing event name from docs.*.cloudsearchdomain.Search.complete-section to docs.*.cloudsearch-domain.Search.complete-section
2026-01-09 09:55:57,585 [267895] DEBUG: Loading JSON file: /usr/local/lib/python3.12/site-packages/boto3/data/s3/2006-03-01/resources-1.json
2026-01-09 09:55:57,589 [267895] DEBUG: IMDS ENDPOINT: http://169.254.169.254/
2026-01-09 09:55:57,591 [267895] DEBUG: Looking for credentials via: env
2026-01-09 09:55:57,591 [267895] INFO: Found credentials in environment variables.
2026-01-09 09:55:57,592 [267895] DEBUG: Loading JSON file: /usr/local/lib/python3.12/site-packages/botocore/data/endpoints.json
2026-01-09 09:55:57,636 [267895] DEBUG: Loading JSON file: /usr/local/lib/python3.12/site-packages/botocore/data/sdk-default-configuration.json
2026-01-09 09:55:57,637 [267895] DEBUG: Event choose-service-name: calling handler <function handle_service_name_alias at 0x7fff9e7f42c0>
2026-01-09 09:55:57,670 [267895] DEBUG: Loading JSON file: /usr/local/lib/python3.12/site-packages/botocore/data/s3/2006-03-01/service-2.json.gz
2026-01-09 09:55:57,693 [267895] DEBUG: Loading JSON file: /usr/local/lib/python3.12/site-packages/botocore/data/s3/2006-03-01/service-2.sdk-extras.json
2026-01-09 09:55:57,723 [267895] DEBUG: Loading JSON file: /usr/local/lib/python3.12/site-packages/botocore/data/s3/2006-03-01/endpoint-rule-set-1.json.gz
2026-01-09 09:55:57,733 [267895] DEBUG: Loading JSON file: /usr/local/lib/python3.12/site-packages/botocore/data/partitions.json
2026-01-09 09:55:57,736 [267895] DEBUG: Event creating-client-class.s3: calling handler <function add_generate_presigned_post at 0x7fff9e76ade0>
2026-01-09 09:55:57,736 [267895] DEBUG: Event creating-client-class.s3: calling handler <function lazy_call.<locals>._handler at 0x7fff9eef1bc0>
2026-01-09 09:55:57,737 [267895] DEBUG: Event creating-client-class.s3: calling handler <function add_generate_presigned_url at 0x7fff9e76ab60>
2026-01-09 09:55:57,738 [267895] DEBUG: Creating a regex based endpoint for s3, default
2026-01-09 09:55:57,740 [267895] DEBUG: Setting s3 timeout as (60, 60)
2026-01-09 09:55:57,743 [267895] DEBUG: Loading JSON file: /usr/local/lib/python3.12/site-packages/botocore/data/_retry.json
2026-01-09 09:55:57,743 [267895] DEBUG: Registering retry handlers for service: s3
2026-01-09 09:55:57,744 [267895] DEBUG: Registering S3 region redirector handler
2026-01-09 09:55:57,744 [267895] DEBUG: Registering S3Express Identity Resolver
2026-01-09 09:55:57,745 [267895] DEBUG: Loading s3:s3
2026-01-09 09:55:57,746 [267895] DEBUG: Event before-parameter-build.s3.HeadBucket: calling handler <function validate_bucket_name at 0x7fff9e7f6020>
2026-01-09 09:55:57,746 [267895] DEBUG: Event before-parameter-build.s3.HeadBucket: calling handler <function remove_bucket_from_url_paths_from_model at 0x7fff9e8102c0>
2026-01-09 09:55:57,747 [267895] DEBUG: Event before-parameter-build.s3.HeadBucket: calling handler <bound method S3RegionRedirectorv2.annotate_request_context of <botocore.utils.S3RegionRedirectorv2 object at 0x7fff9dbe3ef0>>
2026-01-09 09:55:57,747 [267895] DEBUG: Event before-parameter-build.s3.HeadBucket: calling handler <bound method ClientCreator._inject_s3_input_parameters of <botocore.client.ClientCreator object at 0x7fff9dda3680>>
2026-01-09 09:55:57,747 [267895] DEBUG: Event before-parameter-build.s3.HeadBucket: calling handler <function generate_idempotent_uuid at 0x7fff9e7f5e40>
2026-01-09 09:55:57,747 [267895] DEBUG: Event before-parameter-build.s3.HeadBucket: calling handler <function _handle_request_validation_mode_member at 0x7fff9e8109a0>
2026-01-09 09:55:57,747 [267895] DEBUG: Event before-endpoint-resolution.s3: calling handler <function customize_endpoint_resolver_builtins at 0x7fff9e8104a0>
2026-01-09 09:55:57,747 [267895] DEBUG: Event before-endpoint-resolution.s3: calling handler <bound method S3RegionRedirectorv2.redirect_from_cache of <botocore.utils.S3RegionRedirectorv2 object at 0x7fff9dbe3ef0>>
2026-01-09 09:55:57,747 [267895] DEBUG: Calling endpoint provider with parameters: {'Bucket': 's3pgbackupsbucket', 'Region': 'default', 'UseFIPS': False, 'UseDualStack': False, 'Endpoint': 'https://192.168.25.55:6443', 'ForcePathStyle': True, 'Accelerate': False, 'UseGlobalEndpoint': False, 'DisableMultiRegionAccessPoints': False, 'UseArnRegion': True}
2026-01-09 09:55:57,748 [267895] DEBUG: Endpoint provider result: https://192.168.25.55:6443/s3pgbackupsbucket
2026-01-09 09:55:57,748 [267895] DEBUG: Selecting from endpoint provider's list of auth schemes: "sigv4". User selected auth scheme is: "None"
2026-01-09 09:55:57,748 [267895] DEBUG: Selected auth type "v4" as "v4" with signing context params: {'region': 'default', 'signing_name': 's3', 'disableDoubleEncoding': True}
2026-01-09 09:55:57,749 [267895] DEBUG: Event before-call.s3.HeadBucket: calling handler <function add_expect_header at 0x7fff9e7f63e0>
2026-01-09 09:55:57,749 [267895] DEBUG: Event before-call.s3.HeadBucket: calling handler <bound method S3ExpressIdentityResolver.apply_signing_cache_key of <botocore.utils.S3ExpressIdentityResolver object at 0x7fff9e69e9c0>>
2026-01-09 09:55:57,749 [267895] DEBUG: Event before-call.s3.HeadBucket: calling handler <function add_recursion_detection_header at 0x7fff9e7f4cc0>
2026-01-09 09:55:57,749 [267895] DEBUG: Event before-call.s3.HeadBucket: calling handler <function inject_api_version_header_if_needed at 0x7fff9e7f7920>
2026-01-09 09:55:57,749 [267895] DEBUG: Making request for OperationModel(name=HeadBucket) with params: {'url_path': '', 'query_string': {}, 'method': 'HEAD', 'headers': {'User-Agent': 'Boto3/1.40.1 md/Botocore#1.40.1 ua/2.1 os/linux#5.14.0-427.57.1.el9_4.ppc64le md/arch#ppc64le lang/python#3.12.11 md/pyimpl#CPython m/N,b,Z,D cfg/retry-mode#legacy Botocore/1.40.1 Resource'}, 'body': b'', 'auth_path': '/s3pgbackupsbucket/', 'url': 'https://192.168.25.55:6443/s3pgbackupsbucket', 'context': {'client_region': 'default', 'client_config': <botocore.config.Config object at 0x7fff9e839d60>, 'has_streaming_input': False, 'auth_type': 'v4', 'unsigned_payload': None, 'auth_options': ['aws.auth#sigv4'], 's3_redirect': {'redirected': False, 'bucket': 's3pgbackupsbucket', 'params': {'Bucket': 's3pgbackupsbucket'}}, 'input_params': {'Bucket': 's3pgbackupsbucket'}, 'signing': {'region': 'default', 'signing_name': 's3', 'disableDoubleEncoding': True}, 'endpoint_properties': {'authSchemes': [{'disableDoubleEncoding': True, 'name': 'sigv4', 'signingName': 's3', 'signingRegion': 'default'}]}}}
2026-01-09 09:55:57,750 [267895] DEBUG: Event request-created.s3.HeadBucket: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x7fff9db9bf20>>
2026-01-09 09:55:57,750 [267895] DEBUG: Event choose-signer.s3.HeadBucket: calling handler <function set_operation_specific_signer at 0x7fff9e7f5bc0>
2026-01-09 09:55:57,750 [267895] DEBUG: Event before-sign.s3.HeadBucket: calling handler <function remove_arn_from_signing_path at 0x7fff9e810400>
2026-01-09 09:55:57,750 [267895] DEBUG: Event before-sign.s3.HeadBucket: calling handler <function _set_extra_headers_for_unsigned_request at 0x7fff9e810a40>
2026-01-09 09:55:57,750 [267895] DEBUG: Event before-sign.s3.HeadBucket: calling handler <bound method S3ExpressIdentityResolver.resolve_s3express_identity of <botocore.utils.S3ExpressIdentityResolver object at 0x7fff9e69e9c0>>
2026-01-09 09:55:57,751 [267895] DEBUG: Calculating signature using v4 auth.
2026-01-09 09:55:57,751 [267895] DEBUG: CanonicalRequest:
HEAD
/s3pgbackupsbucket

host:192.168.25.55:6443
x-amz-content-sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
x-amz-date:20260109T095557Z

host;x-amz-content-sha256;x-amz-date
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
2026-01-09 09:55:57,751 [267895] DEBUG: StringToSign:
AWS4-HMAC-SHA256
20260109T095557Z
20260109/default/s3/aws4_request
ce83c2558e32dd3a3a15950409b1b5a715af201a749ae2371a206635af635aec
2026-01-09 09:55:57,751 [267895] DEBUG: Signature:
d1f62b99f982b165173192d17507f5d8f895e5b04474a6f3831f17279e05e391
2026-01-09 09:55:57,751 [267895] DEBUG: Event request-created.s3.HeadBucket: calling handler <bound method UserAgentString.rebuild_and_replace_user_agent_handler of <botocore.useragent.UserAgentString object at 0x7fff9e9355b0>>
2026-01-09 09:55:57,751 [267895] DEBUG: Event request-created.s3.HeadBucket: calling handler <function add_retry_headers at 0x7fff9e810220>
2026-01-09 09:55:57,751 [267895] DEBUG: Sending http request: <AWSPreparedRequest stream_output=False, method=HEAD, url=https://192.168.25.55:6443/s3pgbackupsbucket, headers={'User-Agent': b'Boto3/1.40.1 md/Botocore#1.40.1 ua/2.1 os/linux#5.14.0-427.57.1.el9_4.ppc64le md/arch#ppc64le lang/python#3.12.11 md/pyimpl#CPython m/N,b,Z,D cfg/retry-mode#legacy Botocore/1.40.1 Resource', 'X-Amz-Date': b'20260109T095557Z', 'X-Amz-Content-SHA256': b'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855', 'Authorization': b'AWS4-HMAC-SHA256 Credential=0KOVMyQtAV6J4iVFeefX/20260109/default/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=d1f62b99f982b165173192d17507f5d8f895e5b04474a6f3831f17279e05e391', 'amz-sdk-invocation-id': b'd52aed56-66f2-4122-b290-a6ca909e2ac3', 'amz-sdk-request': b'attempt=1'}>
2026-01-09 09:55:57,752 [267895] DEBUG: Starting new HTTPS connection (1): 192.168.25.55:6443
2026-01-09 09:55:57,761 [267895] DEBUG: https://192.168.25.55:6443 "HEAD /s3pgbackupsbucket HTTP/1.1" 403 0
2026-01-09 09:55:57,761 [267895] DEBUG: Event before-parse.s3.HeadBucket: calling handler <function _handle_200_error at 0x7fff9e8107c0>
2026-01-09 09:55:57,761 [267895] DEBUG: Event before-parse.s3.HeadBucket: calling handler <function handle_expires_header at 0x7fff9e8105e0>
2026-01-09 09:55:57,761 [267895] DEBUG: Response headers: {'Server': 'NooBaa/5.18.7', 'x-amz-request-id': 'mk6q1k85-7bnrpz-hld', 'x-amz-id-2': 'mk6q1k85-7bnrpz-hld', 'Content-Type': 'application/xml', 'Content-Length': '266', 'Date': 'Fri, 09 Jan 2026 10:16:36 GMT', 'Connection': 'keep-alive', 'Keep-Alive': 'timeout=5'}
2026-01-09 09:55:57,761 [267895] DEBUG: Response body:
b''
2026-01-09 09:55:57,765 [267895] DEBUG: Event needs-retry.s3.HeadBucket: calling handler <function _update_status_code at 0x7fff9e810900>
2026-01-09 09:55:57,765 [267895] DEBUG: Event needs-retry.s3.HeadBucket: calling handler <botocore.retryhandler.RetryHandler object at 0x7fff9dbe44a0>
2026-01-09 09:55:57,765 [267895] DEBUG: No retry needed.
2026-01-09 09:55:57,765 [267895] DEBUG: Event needs-retry.s3.HeadBucket: calling handler <bound method S3RegionRedirectorv2.redirect_from_error of <botocore.utils.S3RegionRedirectorv2 object at 0x7fff9dbe3ef0>>
2026-01-09 09:55:57,766 [267895] ERROR: Barman cloud WAL archiver exception: An error occurred (403) when calling the HeadBucket operation: Forbidden
2026-01-09 09:55:57,766 [267895] DEBUG: Exception details:
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/barman/clients/cloud_walarchive.py", line 93, in main
    if not cloud_interface.test_connectivity():
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/barman/cloud_providers/aws_s3.py", line 200, in test_connectivity
    self.bucket_exists = self._check_bucket_existence()
                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/barman/cloud_providers/aws_s3.py", line 215, in _check_bucket_existence
    self.s3.meta.client.head_bucket(Bucket=self.bucket_name)
  File "/usr/local/lib/python3.12/site-packages/botocore/client.py", line 601, in _api_call
    return self._make_api_call(operation_name, kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/botocore/context.py", line 123, in wrapper
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/site-packages/botocore/client.py", line 1074, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (403) when calling the HeadBucket operation: Forbidden
bash-4.4$ 
bash-4.4$