api error AccessDenied using PutObject credential-less access to S3 bucket

[pbrown-gh]

I have credential-less access to private S3 buckets. Access is granted to individual Docker containers. I am trying to upload a file using PutObject using the aws-sdk-go-v2 SDK library, but I'm continually getting a 403 AccessDenied api error.

My upload code looks like this:

var uploadFileFunc = func(s3Details S3Details, key string, payload []byte, params MetadataParams) (*s3.PutObjectOutput, error) {
	client := getS3Client(s3Details)

	return client.PutObject(context.TODO(), &s3.PutObjectInput{
		Bucket:      aws.String(s3Details.Bucket),
		Key:         aws.String(key),
		Body:        bytes.NewReader(payload),
		ContentType: aws.String("text/xml"),
	})
}

func getS3Client(s3Details S3Details) *s3.Client {
	endpointResolver := aws.EndpointResolverWithOptionsFunc(func(service, region string, options ...interface{}) (aws.Endpoint, error) {
		endpoint := aws.Endpoint{
			PartitionID:   "aws",
			SigningRegion: s3Details.Region,
			SigningMethod: s3Details.SignatureVersion,
		}

		if s3Details.EndpointUrl != "" {
			endpoint.URL = s3Details.EndpointUrl
			return endpoint, nil
		} else {
			return endpoint, &aws.EndpointNotFoundError{}
		}
	})

	cfg, _ := config.LoadDefaultConfig(context.TODO(),
		config.WithEndpointDiscovery(aws.EndpointDiscoveryEnabled),
		config.WithEndpointResolverWithOptions(endpointResolver))

	return s3.NewFromConfig(cfg, func(o *s3.Options) {
		o.Region = s3Details.Region
		o.Credentials = aws.AnonymousCredentials{}
		o.UsePathStyle = true
	})
}

I am using aws.AnonymousCredentials{} (as our access is credential-less) but this is only supposed to be used for unsigned requests. I cannot use NewStaticCredentialsProvider with empty values for AccessKeyID and/or SecretAccessKey as this will throw a StaticCredentialsEmptyError during the Retrieve(). Adding dummy credentials will throw an error that they are not on record. I am assuming that this is the cause of my 403 AccessDenied.

How do I sign requests without providing credentials in the Go SDK? Is it even possible? In the boto3 Python library this works fine.