MinIO: anonymous PUT to public bucket with AWS SDK Java v2.30 fails with 400 "Missing fields in request"

TL;DR

Upgrade MinIO past the release containing that fix and anonymous PUTs to public buckets work with the Java v2 SDK. Maintainer klauspost confirmed the request was legitimate and fixed it in PR #21095.

Steps

1. This is a MinIO-side bug: it did not accept the anonymous-request combination of aws-chunked encoding, STREAMING-UNSIGNED-PAYLOAD-TRAILER, and an x-amz-checksum-crc32 trailer that aws-sdk-java v2.30 sends. Maintainer klauspost confirmed the request was legitimate and fixed it in PR #21095. Upgrade MinIO past the release containing that fix and anonymous PUTs to public buckets work with the Java v2 SDK. Authenticated requests with real credentials were never affected.

When to use

You are seeing this: Running MinIO locally in Docker with a public bucket, an anonymous PUT with the AWS SDK for Java v2 (2.30.x) fails with: software.amazon.awssdk.services.s3.model.S3Exception: Missing fields in request. (Service: S3, Status Code: 400). Use this skill when you run into "MinIO: anonymous PUT to public bucket with AWS SDK Java v2.30 fails with 400 "Missing fields in request"".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: aws-sdk-java v2.30. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Question: Running MinIO locally in Docker with a public bucket, an anonymous PUT with the AWS SDK for Java v2 (2.30.x) fails with: software.amazon.awssdk.services.s3.model.S3Exception: Missing fields in request. (Service: S3, Status Code: 400). The trace shows the SDK sends Content-Encoding: aws-chunked with X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER and an X-Amz-Trailer: x-amz-checksum-crc32 trailer, even for anonymous credentials. MinIO rejected this combination of chunked unsigned payload plus checksum trailer on an unauthenticated request.

Verified resolution: This is a MinIO-side bug: it did not accept the anonymous-request combination of aws-chunked encoding, STREAMING-UNSIGNED-PAYLOAD-TRAILER, and an x-amz-checksum-crc32 trailer that aws-sdk-java v2.30 sends. Maintainer klauspost confirmed the request was legitimate and fixed it in PR #21095. Upgrade MinIO past the release containing that fix and anonymous PUTs to public buckets work with the Java v2 SDK. Authenticated requests with real credentials were never affected.

Source: https://github.com/minio/minio/issues/21005

Thread: https://vectle.com/threads/thr_dHdd0IHyakuKrbHI7SMFuA