s3 Presigned urls without bucket policy does not work
Here is what I have tried.
Lambda code:
import uuid
import boto3
def lambda_handler(event, context):
# Get the service client.
s3 = boto3.client('s3')
# Generate a random S3 key name
upload_key = uuid.uuid4().hex
# Generate the presigned URL for put requests
presigned_url = s3.generate_presigned_url(
ClientMethod='put_object',
Params={
'Bucket': 'test',
'Key': upload_key,
'ContentType': 'image/png',
'ACL': 'public-read'
}
)
# Return the presigned URL
return {
"upload_url": presigned_url
}
CORS policy for s3 bucket
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>POST</AllowedMethod>
<AllowedMethod>GET</AllowedMethod>
<AllowedMethod>PUT</AllowedMethod>
<AllowedMethod>DELETE</AllowedMethod>
<AllowedMethod>HEAD</AllowedMethod>
<ExposeHeader>ETag</ExposeHeader>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
I have tried to upload objects from curl command
curl -v -H "Content-Type:image/png" -H "public-read" --upload-file ~/Downloads/newlogo.png "presignedurl"
if a public write access is given for the bucket I am able to successfully upload the objects in s3 if not I am getting an access denied 403 exceptions I have gone through most of StackOverflow post not able to figure out the issue please guide me any help is highly appreciated
I am also planning to use this for a website which uploads media files to the s3 bucket using pre-signed URLs .what is the best way to handle authentication for it?
The error i am getting
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>73881648C31D9316</RequestId><HostId>g4BuDVC7XZKLkAwpvztjqDC4GW9y5s9nk+vu1TsLQBl2XeXQOtOeFR+0hmJn0fjW5xkYeAE3pfA=</HostId></Error>
amazon-web-services amazon-s3
asked Nov 19 '18 at 13:13
Manoj RamananManoj Ramanan
510313
add a comment |
Here is what I have tried.
Lambda code:
import uuid
import boto3
def lambda_handler(event, context):
# Get the service client.
s3 = boto3.client('s3')
# Generate a random S3 key name
upload_key = uuid.uuid4().hex
# Generate the presigned URL for put requests
presigned_url = s3.generate_presigned_url(
ClientMethod='put_object',
Params={
'Bucket': 'test',
'Key': upload_key,
'ContentType': 'image/png',
'ACL': 'public-read'
}
)
# Return the presigned URL
return {
"upload_url": presigned_url
}
CORS policy for s3 bucket
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>POST</AllowedMethod>
<AllowedMethod>GET</AllowedMethod>
<AllowedMethod>PUT</AllowedMethod>
<AllowedMethod>DELETE</AllowedMethod>
<AllowedMethod>HEAD</AllowedMethod>
<ExposeHeader>ETag</ExposeHeader>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
I have tried to upload objects from curl command
curl -v -H "Content-Type:image/png" -H "public-read" --upload-file ~/Downloads/newlogo.png "presignedurl"
if a public write access is given for the bucket I am able to successfully upload the objects in s3 if not I am getting an access denied 403 exceptions I have gone through most of StackOverflow post not able to figure out the issue please guide me any help is highly appreciated
I am also planning to use this for a website which uploads media files to the s3 bucket using pre-signed URLs .what is the best way to handle authentication for it?
The error i am getting
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>73881648C31D9316</RequestId><HostId>g4BuDVC7XZKLkAwpvztjqDC4GW9y5s9nk+vu1TsLQBl2XeXQOtOeFR+0hmJn0fjW5xkYeAE3pfA=</HostId></Error>
amazon-web-services amazon-s3
asked Nov 19 '18 at 13:13
Manoj RamananManoj Ramanan
510313
Does your lambda function have permission to write to the s3 bucket?
– cementblocks
Nov 19 '18 at 13:52
@cementblocks No i am just generating presigned URLs from lambda
– Manoj Ramanan
Nov 19 '18 at 13:54
add a comment |
Here is what I have tried.
Lambda code:
import uuid
import boto3
def lambda_handler(event, context):
# Get the service client.
s3 = boto3.client('s3')
# Generate a random S3 key name
upload_key = uuid.uuid4().hex
# Generate the presigned URL for put requests
presigned_url = s3.generate_presigned_url(
ClientMethod='put_object',
Params={
'Bucket': 'test',
'Key': upload_key,
'ContentType': 'image/png',
'ACL': 'public-read'
}
)
# Return the presigned URL
return {
"upload_url": presigned_url
}
CORS policy for s3 bucket
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>POST</AllowedMethod>
<AllowedMethod>GET</AllowedMethod>
<AllowedMethod>PUT</AllowedMethod>
<AllowedMethod>DELETE</AllowedMethod>
<AllowedMethod>HEAD</AllowedMethod>
<ExposeHeader>ETag</ExposeHeader>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
I have tried to upload objects from curl command
curl -v -H "Content-Type:image/png" -H "public-read" --upload-file ~/Downloads/newlogo.png "presignedurl"
if a public write access is given for the bucket I am able to successfully upload the objects in s3 if not I am getting an access denied 403 exceptions I have gone through most of StackOverflow post not able to figure out the issue please guide me any help is highly appreciated
I am also planning to use this for a website which uploads media files to the s3 bucket using pre-signed URLs .what is the best way to handle authentication for it?
The error i am getting
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>73881648C31D9316</RequestId><HostId>g4BuDVC7XZKLkAwpvztjqDC4GW9y5s9nk+vu1TsLQBl2XeXQOtOeFR+0hmJn0fjW5xkYeAE3pfA=</HostId></Error>
amazon-web-services amazon-s3
asked Nov 19 '18 at 13:13
Manoj RamananManoj Ramanan
510313
Here is what I have tried.
Lambda code:
import uuid
import boto3
def lambda_handler(event, context):
# Get the service client.
s3 = boto3.client('s3')
# Generate a random S3 key name
upload_key = uuid.uuid4().hex
# Generate the presigned URL for put requests
presigned_url = s3.generate_presigned_url(
ClientMethod='put_object',
Params={
'Bucket': 'test',
'Key': upload_key,
'ContentType': 'image/png',
'ACL': 'public-read'
}
)
# Return the presigned URL
return {
"upload_url": presigned_url
}
CORS policy for s3 bucket
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>POST</AllowedMethod>
<AllowedMethod>GET</AllowedMethod>
<AllowedMethod>PUT</AllowedMethod>
<AllowedMethod>DELETE</AllowedMethod>
<AllowedMethod>HEAD</AllowedMethod>
<ExposeHeader>ETag</ExposeHeader>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
I have tried to upload objects from curl command
curl -v -H "Content-Type:image/png" -H "public-read" --upload-file ~/Downloads/newlogo.png "presignedurl"
if a public write access is given for the bucket I am able to successfully upload the objects in s3 if not I am getting an access denied 403 exceptions I have gone through most of StackOverflow post not able to figure out the issue please guide me any help is highly appreciated
I am also planning to use this for a website which uploads media files to the s3 bucket using pre-signed URLs .what is the best way to handle authentication for it?
The error i am getting
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>73881648C31D9316</RequestId><HostId>g4BuDVC7XZKLkAwpvztjqDC4GW9y5s9nk+vu1TsLQBl2XeXQOtOeFR+0hmJn0fjW5xkYeAE3pfA=</HostId></Error>
amazon-web-services amazon-s3
amazon-web-services amazon-s3
asked Nov 19 '18 at 13:13
Manoj RamananManoj Ramanan
510313
asked Nov 19 '18 at 13:13
Manoj RamananManoj Ramanan
510313
edited Nov 19 '18 at 14:11
Manoj Ramanan
asked Nov 19 '18 at 13:13
Manoj RamananManoj Ramanan
510313
asked Nov 19 '18 at 13:13
Manoj RamananManoj Ramanan
510313
asked Nov 19 '18 at 13:13
Manoj RamananManoj Ramanan
510313
510313
Does your lambda function have permission to write to the s3 bucket?
– cementblocks
Nov 19 '18 at 13:52
@cementblocks No i am just generating presigned URLs from lambda
– Manoj Ramanan
Nov 19 '18 at 13:54
add a comment |
Does your lambda function have permission to write to the s3 bucket?
– cementblocks
Nov 19 '18 at 13:52
@cementblocks No i am just generating presigned URLs from lambda
– Manoj Ramanan
Nov 19 '18 at 13:54
Does your lambda function have permission to write to the s3 bucket?
– cementblocks
Nov 19 '18 at 13:52
Does your lambda function have permission to write to the s3 bucket?
– cementblocks
Nov 19 '18 at 13:52
@cementblocks No i am just generating presigned URLs from lambda
– Manoj Ramanan
Nov 19 '18 at 13:54
@cementblocks No i am just generating presigned URLs from lambda
– Manoj Ramanan
Nov 19 '18 at 13:54
add a comment |
1 Answer
1
active
oldest
votes
When you create pre-signed a url for s3 put object (or any other api call) that signed request uses the credentials that the SDK is configured with, in this case your lambda's role. Give your Lambda's IAM role write access to this s3 bucket and your uploads will succeed.
answered Nov 19 '18 at 14:01
cementblockscementblocks
1,709814
Let me check and get back to you
– Manoj Ramanan
Nov 19 '18 at 14:03
I gave Lamba S3 full access but still it is not working
– Manoj Ramanan
Nov 19 '18 at 14:08
What error do you get?
– cementblocks
Nov 19 '18 at 14:09
please check the question
– Manoj Ramanan
Nov 19 '18 at 14:11
If I add policy to S3 bukcet for public write it is working but I don't want to do that
– Manoj Ramanan
Nov 19 '18 at 14:13
|
show 3 more comments
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53375424%2fs3-presigned-urls-without-bucket-policy-does-not-work%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
When you create pre-signed a url for s3 put object (or any other api call) that signed request uses the credentials that the SDK is configured with, in this case your lambda's role. Give your Lambda's IAM role write access to this s3 bucket and your uploads will succeed.
answered Nov 19 '18 at 14:01
cementblockscementblocks
1,709814
Let me check and get back to you
– Manoj Ramanan
Nov 19 '18 at 14:03
I gave Lamba S3 full access but still it is not working
– Manoj Ramanan
Nov 19 '18 at 14:08
What error do you get?
– cementblocks
Nov 19 '18 at 14:09
please check the question
– Manoj Ramanan
Nov 19 '18 at 14:11
If I add policy to S3 bukcet for public write it is working but I don't want to do that
– Manoj Ramanan
Nov 19 '18 at 14:13
|
show 3 more comments
When you create pre-signed a url for s3 put object (or any other api call) that signed request uses the credentials that the SDK is configured with, in this case your lambda's role. Give your Lambda's IAM role write access to this s3 bucket and your uploads will succeed.
answered Nov 19 '18 at 14:01
cementblockscementblocks
1,709814
Let me check and get back to you
– Manoj Ramanan
Nov 19 '18 at 14:03
I gave Lamba S3 full access but still it is not working
– Manoj Ramanan
Nov 19 '18 at 14:08
What error do you get?
– cementblocks
Nov 19 '18 at 14:09
please check the question
– Manoj Ramanan
Nov 19 '18 at 14:11
If I add policy to S3 bukcet for public write it is working but I don't want to do that
– Manoj Ramanan
Nov 19 '18 at 14:13
|
show 3 more comments
When you create pre-signed a url for s3 put object (or any other api call) that signed request uses the credentials that the SDK is configured with, in this case your lambda's role. Give your Lambda's IAM role write access to this s3 bucket and your uploads will succeed.
answered Nov 19 '18 at 14:01
cementblockscementblocks
1,709814
When you create pre-signed a url for s3 put object (or any other api call) that signed request uses the credentials that the SDK is configured with, in this case your lambda's role. Give your Lambda's IAM role write access to this s3 bucket and your uploads will succeed.
answered Nov 19 '18 at 14:01
cementblockscementblocks
1,709814
answered Nov 19 '18 at 14:01
cementblockscementblocks
1,709814
answered Nov 19 '18 at 14:01
cementblockscementblocks
1,709814
answered Nov 19 '18 at 14:01
cementblockscementblocks
1,709814
1,709814
Let me check and get back to you
– Manoj Ramanan
Nov 19 '18 at 14:03
I gave Lamba S3 full access but still it is not working
– Manoj Ramanan
Nov 19 '18 at 14:08
What error do you get?
– cementblocks
Nov 19 '18 at 14:09
please check the question
– Manoj Ramanan
Nov 19 '18 at 14:11
If I add policy to S3 bukcet for public write it is working but I don't want to do that
– Manoj Ramanan
Nov 19 '18 at 14:13
|
show 3 more comments
Let me check and get back to you
– Manoj Ramanan
Nov 19 '18 at 14:03
I gave Lamba S3 full access but still it is not working
– Manoj Ramanan
Nov 19 '18 at 14:08
What error do you get?
– cementblocks
Nov 19 '18 at 14:09
please check the question
– Manoj Ramanan
Nov 19 '18 at 14:11
If I add policy to S3 bukcet for public write it is working but I don't want to do that
– Manoj Ramanan
Nov 19 '18 at 14:13
Let me check and get back to you
– Manoj Ramanan
Nov 19 '18 at 14:03
Let me check and get back to you
– Manoj Ramanan
Nov 19 '18 at 14:03
I gave Lamba S3 full access but still it is not working
– Manoj Ramanan
Nov 19 '18 at 14:08
I gave Lamba S3 full access but still it is not working
– Manoj Ramanan
Nov 19 '18 at 14:08
What error do you get?
– cementblocks
Nov 19 '18 at 14:09
What error do you get?
– cementblocks
Nov 19 '18 at 14:09
please check the question
– Manoj Ramanan
Nov 19 '18 at 14:11
please check the question
– Manoj Ramanan
Nov 19 '18 at 14:11
If I add policy to S3 bukcet for public write it is working but I don't want to do that
– Manoj Ramanan
Nov 19 '18 at 14:13
If I add policy to S3 bukcet for public write it is working but I don't want to do that
– Manoj Ramanan
Nov 19 '18 at 14:13
|
show 3 more comments
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53375424%2fs3-presigned-urls-without-bucket-policy-does-not-work%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Does your lambda function have permission to write to the s3 bucket?
– cementblocks
Nov 19 '18 at 13:52
@cementblocks No i am just generating presigned URLs from lambda
– Manoj Ramanan
Nov 19 '18 at 13:54