Access Denied when requesting a geoTiff from protected s3 bucket

[AliceBalfanz]

Describe the bug
When I try to read a geotiff from a protected s3 bucket, I receive an Access Denied Error. The credentials used have sufficient permissions as I can access a .zarr in the same bucket without issues. The geotiff appears in the list of datasets in the store but when actually accessing it the error appears.

To Reproduce
Steps to reproduce the behavior:

1. Put a sample geotiff in a private s3 bucket

from xcube.core.store import new_data_store
store = new_data_store("s3",
                            root=<private-bucket-path>,
                            storage_options=dict(anon=False,
                                                 key=credentials-key,
                                                 secret=credentials-secret))

list(store.get_data_ids())

['sample-cog.tif',
 'sample-geotiff.tif',
 'test-cube.zarr']

store.describe_data('sample-cog.tif')

Traceback:

/home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/rasterio/env.py:167: RasterioDeprecationWarning: Passing abstract session keyword arguments is deprecated. Pass a Rasterio AWSSession object instead.
  warnings.warn(

---------------------------------------------------------------------------
KeyError                                  Traceback (most recent call last)
File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/xarray/backends/file_manager.py:211, in CachingFileManager._acquire_with_cache_info(self, needs_lock)
    210 try:
--> 211     file = self._cache[self._key]
    212 except KeyError:

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/xarray/backends/lru_cache.py:56, in LRUCache.__getitem__(self, key)
     55 with self._lock:
---> 56     value = self._cache[key]
     57     self._cache.move_to_end(key)

KeyError: [<function open at 0x7f7ca2f5b740>, ('s3://hub-deepesdl3/sample-cog.tif',), 'r', (('overview_level', None), ('sharing', False)), '72f95167-dbe2-4c79-98c2-f232273e411d']

During handling of the above exception, another exception occurred:

CPLE_AWSAccessDeniedError                 Traceback (most recent call last)
File rasterio/_base.pyx:308, in rasterio._base.DatasetBase.__init__()

File rasterio/_base.pyx:219, in rasterio._base.open_dataset()

File rasterio/_err.pyx:221, in rasterio._err.exc_wrap_pointer()

CPLE_AWSAccessDeniedError: Access Denied

During handling of the above exception, another exception occurred:

RasterioIOError                           Traceback (most recent call last)
Cell In[5], line 1
----> 1 store.describe_data('sample-cog.tif')

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/xcube/core/store/fs/store.py:289, in BaseFsDataStore.describe_data(self, data_id, data_type)
    283 # TODO: optimize me, self.open_data() may be very slow!
    284 #   For Zarr, try using self.fs to load metadata only
    285 #   rather than instantiating xr.Dataset instances which
    286 #   can be very expensive for large Zarrs (xarray 0.18.2),
    287 #   especially in S3 filesystems.
    288 data = self.open_data(data_id)
--> 289 return new_data_descriptor(data_id, data, require=True)

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/xcube/core/store/descriptor.py:72, in new_data_descriptor(data_id, data, require)
     64 def new_data_descriptor(data_id: str, data: Any, require: bool = False) \
     65         -> 'DataDescriptor':
     66     if isinstance(data, MultiLevelDataset):
     67         dataset_descriptor_kwargs = _get_common_dataset_descriptor_props(
     68             data_id,
     69             # Note The highest level should have same metadata
     70             # and maybe loads faster.
     71             # data.get_dataset(data.num_levels - 1)
---> 72             data.get_dataset(0)
     73         )
     74         return MultiLevelDatasetDescriptor(
     75             num_levels=data.num_levels,
     76             **dataset_descriptor_kwargs
     77         )
     79     if isinstance(data, xr.Dataset):

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/xcube/core/mldataset/lazy.py:102, in LazyMultiLevelDataset.get_dataset(self, index)
     99 if index not in self._level_datasets:
    100     with self._lock:
    101         # noinspection PyTypeChecker
--> 102         level_dataset = self._get_dataset_lazily(index,
    103                                                  self._parameters)
    104         self.set_dataset(index, level_dataset)
    105 # noinspection PyTypeChecker

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/xcube/core/store/fs/impl/geotiff.py:80, in GeoTIFFMultiLevelDataset._get_dataset_lazily(self, index, parameters)
     78 tile_size = self._open_params.get("tile_size", (512, 512))
     79 self._file_url = self._get_file_url()
---> 80 return DatasetGeoTiffFsDataAccessor.open_dataset(
     81     self._fs,
     82     self._file_url,
     83     tile_size,
     84     overview_level=index - 1 if index > 0 else None
     85 )

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/xcube/core/store/fs/impl/dataset.py:422, in DatasetGeoTiffFsDataAccessor.open_dataset(cls, fs, file_path, tile_size, overview_level)
    420 if isinstance(fs, fsspec.AbstractFileSystem):
    421     with cls.create_env_session(fs):
--> 422         array = cls.open_dataset_with_rioxarray(file_path,
    423                                                 overview_level,
    424                                                 tile_size)
    425 else:
    426     assert_true(fs is None, message="invalid type for fs")

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/xcube/core/store/fs/impl/dataset.py:394, in DatasetGeoTiffFsDataAccessor.open_dataset_with_rioxarray(cls, file_path, overview_level, tile_size)
    391 @classmethod
    392 def open_dataset_with_rioxarray(cls, file_path, overview_level,
    393                                 tile_size) -> rioxarray.raster_array:
--> 394     return rioxarray.open_rasterio(
    395         file_path,
    396         overview_level=overview_level,
    397         chunks=dict(zip(('x', 'y'), tile_size))
    398     )

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/rioxarray/_io.py:1124, in open_rasterio(filename, parse_coordinates, chunks, cache, lock, masked, mask_and_scale, variable, group, default_name, decode_times, decode_timedelta, band_as_variable, **open_kwargs)
   1122     else:
   1123         manager = URIManager(file_opener, filename, mode="r", kwargs=open_kwargs)
-> 1124     riods = manager.acquire()
   1125     captured_warnings = rio_warnings.copy()
   1127 # raise the NotGeoreferencedWarning if applicable

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/xarray/backends/file_manager.py:193, in CachingFileManager.acquire(self, needs_lock)
    178 def acquire(self, needs_lock=True):
    179     """Acquire a file object from the manager.
    180 
    181     A new file is only opened if it has expired from the
   (...)
    191         An open file object, as returned by ``opener(*args, **kwargs)``.
    192     """
--> 193     file, _ = self._acquire_with_cache_info(needs_lock)
    194     return file

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/xarray/backends/file_manager.py:217, in CachingFileManager._acquire_with_cache_info(self, needs_lock)
    215     kwargs = kwargs.copy()
    216     kwargs["mode"] = self._mode
--> 217 file = self._opener(*self._args, **kwargs)
    218 if self._mode == "w":
    219     # ensure file doesn't get overridden when opened again
    220     self._mode = "a"

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/rasterio/env.py:451, in ensure_env_with_credentials.<locals>.wrapper(*args, **kwds)
    448     session = DummySession()
    450 with env_ctor(session=session):
--> 451     return f(*args, **kwds)

File /home/conda/deepesdl/c26e0a8bb714a50fd3e0e099f676a719354888157909a75e62a593862149506e-20230628-082138-397317-264-xcube-1.1.1/lib/python3.11/site-packages/rasterio/__init__.py:304, in open(fp, mode, driver, width, height, count, crs, transform, dtype, nodata, sharing, **kwargs)
    301 path = _parse_path(raw_dataset_path)
    303 if mode == "r":
--> 304     dataset = DatasetReader(path, driver=driver, sharing=sharing, **kwargs)
    305 elif mode == "r+":
    306     dataset = get_writer_for_path(path, driver=driver)(
    307         path, mode, driver=driver, sharing=sharing, **kwargs
    308     )

File rasterio/_base.pyx:310, in rasterio._base.DatasetBase.__init__()

RasterioIOError: Access Denied

Expected behavior
When I access the same sample geotiff from a public bucket, no problems appear. I would expect the same in the private bucket as I pass credentials with sufficient permissions.