Access Denied Error While Loading Images from AWS S3 Buckets

user_14677435 0
Viewed 1709

I am trying to load my static image files using AWS S3 Buckets in my Django Project, but I am getting access denied error. I created a IAM user and granted full access to S3. I also installed django-storages and boto3. I have added 'storages' in INSTALLED_APPS list in settings.py

This is the error:

<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>41C48F59569D1B9F</RequestId>
<HostId>OBKr0zh+DmpcbvesTTFi9wLmKb4Y8GMgg7knOMKlcVBLkU47SKPEyttj4sUjY3cbu8hkfjCpos0=</HostId>
</Error>

This is my settings.py configuration:

STATIC_URL = '/static/'

STATICFILES_DIRS = [
    os.path.join(BASE_DIR, 'static')
]

MEDIA_URL = '/images/'

MEDIA_ROOT = os.path.join(BASE_DIR, 'static/images')

AWS_ACCESS_KEY_ID = '***'
AWS_SECRET_ACCESS_KEY = '***'
AWS_STORAGE_BUCKET_NAME = 'bucket-name'
AWS_S3_FILE_OVERWRITE = False
AWS_DEFAULT_ACL = None
AWS_S3_REGION_NAME = 'us-east-2'
DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'
STATICFILES_STORAGE = 'storages.backends.s3boto3.S3StaticStorage'

This is my CORS code:

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "POST",
            "GET",
            "PUT"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": []
    }
]

This is my Bucket-Policy:

{
    "Version": "2012-10-17",
    "Id": "ExamplePolicy01",
    "Statement": [
        {
            "Sid": "PublicReadForGetBucketObjects",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::sample"
            },
            "Action": [
                "s3:GetObject",
                "s3:GetBucketLocation",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucket/*",
                "arn:aws:s3:::bucket"
            ]
        }
    ]
}
amazon-web-services amazon-s3 django
3 Answers

First of all, you need to go to Permissions tab and uncheck Block all public access. Then in the properties tab of the bucket there is an option called 'Static Website Hosting'. You need to enable it and set configurations. In my case, I used 'Redirect Request' and set the url path as 'http://bucket-name.s3-website.us-east-2.amazonaws.com'

Then, I checked select all box to select all the individual static files and in Actions I selected 'Make Public'

This helped me to load my static files in Django Project.

My CORS code is:

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "POST",
            "GET",
            "PUT"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": []
    }
]

My Bucket Policy is:

{
    "Version": "2012-10-17",
    "Id": "ExamplePolicy01",
    "Statement": [
        {
            "Sid": "PublicReadForGetBucketObjects",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/bucket"
            },
            "Action": [
                "s3:GetObject",
                "s3:GetBucketLocation",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucket/*",
                "arn:aws:s3:::bucket"
            ]
        }
    ]
}
user_146774350

Please make sure the bucket policy is in correct format:

{
    "Version": "2012-10-17",
    "Id": "ExamplePolicy01",
    "Statement": [
        {
            "Sid": "PublicReadForGetBucketObjects",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:user/bucket"
            },
            "Action": [
                "s3:GetObject",
                "s3:GetBucketLocation",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucket/*",
                "arn:aws:s3:::bucket"
            ]
        }
    ]
}
user_153452710

You can just allow public reads on the bucket via the policy Granting Read-Only Permission to an Anonymous User 

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Sid":"PublicRead",
      "Effect":"Allow",
      "Principal": "*",
      "Action":["s3:GetObject","s3:GetObjectVersion"],
      "Resource":["arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"]
    }
  ]
}
user_22463450
Related