xcube serve: ValueError: group not found at path ' ' when using cubes from s3 bucket with access credentials

[AliceBalfanz]

Describe the bug
When starting an xcube server where the cube locations and configurations are specified via a configuration.yml and the cube is located in an s3 bucket which is access-protected, the cube cannot be displayed in a xcube vierwer due to 'ValueError: group not found at path'' of xcube serve.

To Reproduce
Steps to reproduce the behavior:

1. Create a config yml

Datasets:

• Identifier: s2-rgb
  Title: "Sentinel-2 RGB"
  Format: zarr
  Endpoint: "https://s3.eu-central-1.amazonaws.com"
  Path: "/eurodatacube-test/demo/xcube-gen-489bb051-61e3-4854-bb6e-c05213b4fd15.zarr"
  FileSystem: "obs"
  AccessKeyId: "dcfs-user-acces-id"
  SecretAccessKey: "dcfs-user-access-key"
  Region: "eu-central-1"
  Style: default

Styles:

• Identifier: default
  ColorMappings:
  B02:
  ColorBar: "bone"
  ValueRange: [0., 0.05]
  B03:
  ColorBar: "bone"
  ValueRange: [0., 0.05]
  B04:
  ColorBar: "bone"
  ValueRange: [0., 0.05]
  rgb:
  Red:
  Variable: B04
  ValueRange: [0., 0.25]
  Green:
  Variable: B03
  ValueRange: [0., 0.25]
  Blue:
  Variable: B02
  ValueRange: [0., 0.25]

2. run xcube serve with xcube serve -c config.yml -v
3. start xcube viewer using localhost as server address
4. See error

Expected behavior
By passing the correct AccesKeyId and SecretAccessKey the cube should be displayed in the viewer without any issues.
The same cube can be opened via the xcube python api by
from xcube.core.dsio import open_cube
ds = open_cube('https://s3.eu-central-1.amazonaws.com/eurodatacube-test/demo/xcube-gen-489bb051-61e3-4854-bb6e-c05213b4fd15.zarr', client_kwargs=client_kwargs)

[AliceBalfanz]

Works, when using only 'Path' and not 'Endpoint'

Datasets:

    Identifier: s2-rgb
    Title: "Sentinel-2 RGB"
    Format: zarr
    Path: "https://s3.eu-central-1.amazonaws.com/eurodatacube-test/demo/xcube-gen-489bb051-61e3-4854-bb6e-c05213b4fd15.zarr"
    FileSystem: "obs"
    AccessKeyId: "dcfs-user-acces-id"
    SecretAccessKey: "dcfs-user-access-key"
    Region: "eu-central-1"
    Style: default

[rabernat]

Tagging as related to zarr-developers/zarr-python#605. Would a better error message from zarr be helpful here?

[forman]

Would a better error message from zarr be helpful here?

Oh, yes. This message is definitely confusing to (new) users of xcube/xarray/zarr. We are meanwhile used to it :)

[forman]

Cannot reproduce anymore. Reopen if needed.