Error when uploading images. botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the PutObject operation

user_3941231 0
Viewed 157

I am storing profile pictures for my app in AWS S3. I have it working on my localhost, but when I do it in production, I get the error:

[Wed Nov 04 00:34:53.554807 2020] [:error] [pid 14967] [remote 172.31.2.3:112] botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied

Below is a portion of my bucket policy pertaining to PutObject:

    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "*****",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam:::******role/aws-elasticbeanstalk-ec2-role"
            },
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::******/resources/environments/logs/*"
        },

I'm not sure why this would work on my localhost but not when I deploy it. Any help would be appreciated.

amazon-web-services amazon-s3 python
1 Answers

I was finally able to get this to work. It required me to make a new role policy for the role used in my bucket policy. Here's my custom role policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectTagging",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::elasticbeanstalk-us-east-2-*****/profile-pictures/*",
                "arn:aws:s3:::elasticbeanstalk-us-east-2-*****"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:GetAccessPoint",
                "s3:GetAccountPublicAccessBlock",
                "s3:ListAllMyBuckets",
                "s3:ListAccessPoints",
                "s3:ListJobs"
            ],
            "Resource": "*"
        }
    ]
}

I'm not sure why I had to make this policy. In my bucket policy, I already had these actions allowed with this role. It could be that I had to explicitly specify the profile picture resource folder, but I'm not sure.

user_39412310
Related