CODEWITHSUNDEEP
python-3.xamazon-web-servicesamazon-s3boto3boto
Hoai Thai
Hoai Thai

Reputation: 41

Boto/Boto3: bucket.get_key(): 403 Forbidden

I am trying to connect to AWS S3 without using credentials. I attached the Role S3 fullaccess for my instance to check if the file exists or not; if it is not, upload it into S3 bucket. If is isn't I want to check md5sum and if it is different from the local local file, upload a new version.

I try to get key of file in S3 via boto by using bucket.get_key('mykey') and get this error:

File "/usr/local/lib/python3.5/dist-packages/boto/s3/bucket.py", line 193, in get_key key, resp = self._get_key_internal(key_name, headers, query_args_l)

File "/usr/local/lib/python3.5/dist-packages/boto/s3/bucket.py", line 232, in _get_key_internal response.status, response.reason, '') boto.exception.S3ResponseError: S3ResponseError: 403 Forbidden"

I searched and added "validate=False" when getting the bucket, but this didn't resolve my issue. I'm using Python 3.5, boto and boto3.

Here is my code:

import boto3
import boto
from boto import ec2
import os
import boto.s3.connection
from boto.s3.key import Key

bucket_name = "abc"

conn = boto.s3.connect_to_region('us-west-1', is_secure = True, calling_format = boto.s3.connection.OrdinaryCallingFormat())
bucket = conn.get_bucket(bucket_name, validate=False)
key = bucket.get_key('xxxx')

print (key)

I don't know why I get that error. Please help me to clearly this problem. Thanks!

Updated

I've just find root cause this problem. Cause by "The difference between the request time and the current time is too large". Then it didn't get key of file from S3 bucket. I updated ntp service to synchronize local time and UTC time. It run success. Synchronization time by:

sudo service ntp stop
sudo ntpdate -s  0.ubuntu.pool.ntp.org
sudo service ntp start

Thanks!

Upvotes: 0

Views: 1636

Answers (1)

helloV
helloV

Reputation: 52463

IAM role is the last in the order of search. I bet you have the credentials stored before the search order which doesn't have full S3 access. Check Configuration Settings and Precedence and make sure no credentials is present so that IAM role is used to fetch the credentials. Though it is for CLI, it applies to scripts too.

The AWS CLI looks for credentials and configuration settings in the following order:

  1. Command line options – region, output format and profile can be specified as command options to override default settings.

  2. Environment variables – AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN.

  3. The AWS credentials file – located at ~/.aws/credentials on Linux, macOS, or Unix, or at C:\Users\USERNAME .aws\credentials on Windows. This file can contain multiple named profiles in addition to a default profile.

  4. The CLI configuration file – typically located at ~/.aws/config on Linux, macOS, or Unix, or at C:\Users\USERNAME .aws\config on Windows. This file can contain a default profile, named profiles, and CLI specific configuration parameters for each.

  5. Container credentials – provided by Amazon Elastic Container Service on container instances when you assign a role to your task.

  6. Instance profile credentials – these credentials can be used on EC2 instances with an assigned instance role, and are delivered through the Amazon EC2 metadata service.

Upvotes: 1

Related Questions