Catch forbidden errors as notfound

[damccorm]

When getting a bucket, if the bucket does not exist it can manifest as forbidden as well (basically, the error is "I don't know if this bucket exists or not"). In those cases, we should probably treat the bucket as not found. This is currently causing some precommit failures, for example https://github.com/apache/beam/actions/runs/11888837746/job/33124186007

Fixes #31285
Fixes #30813

---

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

• Mention the appropriate issue in your description (for example: addresses #123), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment fixes #<ISSUE NUMBER> instead.
• Update CHANGES.md with noteworthy changes.
• If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.

To check the build health, please visit https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md

GitHub Actions Tests Status (on master branch)

See CI.md for more information about GitHub Actions CI or the workflows README to see a list of phrases to trigger workflows.

[damccorm]

R: @shunping

[github-actions]

Stopping reviewer notifications for this pull request: review requested by someone other than the bot, ceding control. If you'd like to restart, comment assign set of reviewers

[claudevdm]

The method that is failing exists() [1], which calls _gcs_object().

The Forbidden error mentions it can be a permission issue or the bucket does not exist. So we might swallow actual permission issues too.

I think we can list the buckets with a prefix to check for existence explicitly.

client.list_buckets(prefix=bucket_name)

[1]

beam/sdks/python/apache_beam/io/gcp/gcsio.py

Line 404 in 8da9bbe

def exists(self, path):

[damccorm]

Yeah, you're right about it being exists, I added it there as well.

The Forbidden error mentions it can be a permission issue or the bucket does not exist. So we might swallow actual permission issues too.

I think this is going to be true even if we do what you're suggesting. If there are permissions issues, the bucket won't show up in our list call either

[damccorm]

Closing in favor of #33151