From 9c212997dcb9e522ddb75ab592f8440ad8c3eb5f Mon Sep 17 00:00:00 2001
From: Andrii Bratanin <20169213+andriibratanin@users.noreply.github.com>
Date: Wed, 11 Feb 2026 21:03:02 +0200
Subject: [PATCH] feat: allow anonymous access for s3proxy backend

* Update client.go to support anonymous S3 access

* Update s3.go to make access and secret parameters optional

* Update example.conf for more clear S3 access and secret usage

Fixes #1836
---
 backend/s3proxy/client.go | 12 +++++++++++-
 cmd/versitygw/s3.go       |  2 --
 extra/example.conf        |  5 +++--
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/backend/s3proxy/client.go b/backend/s3proxy/client.go
index 06d45442..69b318b2 100644
--- a/backend/s3proxy/client.go
+++ b/backend/s3proxy/client.go
@@ -17,6 +17,7 @@ package s3proxy
 import (
 	"context"
 	"crypto/tls"
+	"fmt"
 	"net/http"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
@@ -48,7 +49,16 @@ func (s *S3Proxy) getClientWithCtx(ctx context.Context) (*s3.Client, error) {
 }
 
 func (s *S3Proxy) getConfig(ctx context.Context, access, secret string) (aws.Config, error) {
-	creds := credentials.NewStaticCredentialsProvider(access, secret, "")
+	if (access != "" && secret == "") || (access == "" && secret != "") {
+		return aws.Config{}, fmt.Errorf("both access and secret must be set or none at all")
+	}
+
+	var creds aws.CredentialsProvider
+	if access != "" {
+		creds = credentials.NewStaticCredentialsProvider(access, secret, "")
+	} else {
+		creds = aws.AnonymousCredentials{}
+	}
 
 	tr := &http.Transport{
 		TLSClientConfig: &tls.Config{InsecureSkipVerify: s.sslSkipVerify},
diff --git a/cmd/versitygw/s3.go b/cmd/versitygw/s3.go
index a4dcac82..cb7aad8a 100644
--- a/cmd/versitygw/s3.go
+++ b/cmd/versitygw/s3.go
@@ -45,7 +45,6 @@ to an s3 storage backend service.`,
 				Name:        "access",
 				Usage:       "s3 proxy server access key id",
 				Value:       "",
-				Required:    true,
 				EnvVars:     []string{"VGW_S3_ACCESS_KEY"},
 				Destination: &s3proxyAccess,
 				Aliases:     []string{"a"},
@@ -54,7 +53,6 @@ to an s3 storage backend service.`,
 				Name:        "secret",
 				Usage:       "s3 proxy server secret access key",
 				Value:       "",
-				Required:    true,
 				EnvVars:     []string{"VGW_S3_SECRET_KEY"},
 				Destination: &s3proxySecret,
 				Aliases:     []string{"s"},
diff --git a/extra/example.conf b/extra/example.conf
index d8311f69..b4a60a89 100644
--- a/extra/example.conf
+++ b/extra/example.conf
@@ -524,8 +524,9 @@ ROOT_SECRET_ACCESS_KEY=
 # S3 service.
 
 # When s3 backend selected, the VGW_S3_ACCESS_KEY and VGW_S3_SECRET_KEY must
-# be defined. The VGW_S3_REGION and VGW_S3_ENDPOINT are optional, and will
-# default to "us-east-1" and "https://s3.amazonaws.com" respectively.
+# be defined for an authorized access or both empty for an anonymous access.
+# The VGW_S3_REGION and VGW_S3_ENDPOINT are optional, and will default to
+# "us-east-1" and "https://s3.amazonaws.com" respectively.
 #VGW_S3_ACCESS_KEY=
 #VGW_S3_SECRET_KEY=
 #VGW_S3_REGION=