CODEWITHSUNDEEP
amazon-web-servicesamazon-s3bucket
James Stewart
James Stewart

Reputation: 1054

AWS: Does my S3 bucket need a policy for files to be readable from my application?

I have a Laravel application that is hosted on AWS. I am using an S3 bucket to store files. I know that I have successfully connected to this bucket because when I upload files, they appear as I would expect inside the bucket's directories.

However, when I try to use the URL attached to the uploaded file to display it, I receive a 403 Forbidden error.

I have an IAM user set up named laravel which has the permission AmazonS3FullAccess applied to it, and I am using that key/secret.

I have the Object URL like so:

https://<BUCKET NAME>.s3.eu-west-1.amazonaws.com/<DIR>/<FILENAME>.webm

But if I try to access that either in my app (fed into an audio player) or just via the link directly, I get a 403. None of the tutorials I've followed to get this working involve Bucket Policies, but when I've googled the problems I'm having, Bucket Policy seems to come up.

Is there a single source of truth on how I am to do this? My AWS knowledge is very limited, but I am trying to get better!

Upvotes: 0

Views: 166

Answers (1)

jarmod
jarmod

Reputation: 78573

When you request a URL of the form https://bucket.s3.amazonaws.com/dog/snoopy.png, that request is unauthenticated. Your S3 bucket policy does not allow unauthenticated access to the contents of the bucket so that request is denied with 403.

If you want your files to be downloadable by an unauthenticated/anonymous client then create an S3 bucket policy to allow that.

Alternatively, your server can create signed URLs and share those with the client.

Otherwise, your client's requests need to be authenticated, which means having correctly-permissioned credentials and using an AWS SDK.

Typically, back-end applications that you write that need access to data in S3 (or other AWS resources) would be given AWS credentials allowing the necessary access. If your back-end application runs in AWS then you would do that by launching the compute with an IAM role.

Typically, front-end applications would not have AWS credentials. Instead they would either authenticate to a back-end that then does work with AWS resources on their behalf. There are other options, however, such as AWS Amplify apps.

Upvotes: 1

Related Questions