Access denied (\"java.io.FilePermission\" \"/usr/share/elasticsearch/.aws/config\" \"read\")"

[dunkelbunt1]

I am having the following issue with elastic-search 7.9.0 and the repository-s3 plugin.

"stacktrace": ["java.security.AccessControlException: access denied (\"java.io.FilePermission\" \"/usr/share/elasticsearch/.aws/config\" \"read\")",
"at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) ~[?:?]",
"at java.security.AccessController.checkPermission(AccessController.java:1036) ~[?:?]",
"at java.lang.SecurityManager.checkPermission(SecurityManager.java:408) ~[?:?]",
"at java.lang.SecurityManager.checkRead(SecurityManager.java:747) ~[?:?]",
"at java.io.File.exists(File.java:818) ~[?:?]",

My Dockerfile looks like this:

FROM docker.elastic.co/elasticsearch/elasticsearch:7.7.1
RUN elasticsearch-plugin install --batch repository-s3

I can see the stack-trace appearing only once after every restart.
My aws/s3 credentials do get directly added into the key-store so I am not sure why it is trying to read "/usr/share/elasticsearch/.aws/config"

Does anyone know what can cause this?

[elasticmachine]

Pinging @elastic/es-distributed (:Distributed/Snapshot/Restore)

[DaveCTurner]

Thanks for the report @dunkelbunt1. This is just unnecessary noise emitted by the AWS SDK and you can safely ignore it. I opened #62522 to suppress this logging in future.

[thomaswitt]

@dunkelbunt1 If you're as annoyed about this logfile spam as I am, add this line in the es-setup when the file permissions are set: touch config/certs/aws-config-file, and then set the environment of e.g. es01 to AWS_CONFIG_FILE=/usr/share/elasticsearch/config/certs/aws-config-file