Access Denied when downloading via Signed URLs

user_5514439 0
Viewed 4425

I am using an IAM role to access S3 from my EC2 instance. But in my application, I create a signed URL for downloading the files. However, when the user tries to download the files, it is showing access denied errors.

var AWS = require('aws-sdk');
var s3 = new AWS.S3();

//key=file path
var params = {Bucket: bucket, Key: prefix+'/'+key, Expires: 240}
var url = s3.getSignedUrl('getObject', params)
console.log(req.cookies.s, 'got', url) // expires in 60 seconds
res.redirect(url)
amazon-web-services amazon-s3
2 Answers

The fact that you are providing Signed URLs and they result in an Access Denied error says that the Signed URL is not valid.

Some potential reasons:

  • The Signed URL was incorrectly constructed (you didn't show us your code, so we can't determine this)
  • The credentials used to generate the Signed URL does not have permission to access the objects (a Signed URL is a way to authorise temporary, limited usage of credentials, but the underlying credentials must have access to the resource)
  • The time period for the Signed URL expired (but this would result in a different error message)
  • The object does not exist (which is quite likely, since Access Denied suggests this, rather than displaying an error related to the Signed URL)
user_1747770

Thanks for @john 's answer to point out the main issue with the Access Deniedis that the signed URL is not valid.

I want to add another thing that helps sort this issue out. Even you don't have correct credentials to the bucket, you will still be able to generate the signed URL!

That's where it got me stuck, as I didn't think my credentials were not correct as I generated the URL successfully.

user_9800500
Related