3

I am working on iOS Application, where i need to upload the images in to AWS S3Bucket. I have got the temporary credential(accessKey,secretKey, sessionToken and bucketName) from the server to upload the images.

I am finding it difficult to identify the correct API to use this credential to upload the images.

AWS sample program is given using AWSCognitoCredentialsProvider.

I have got the working Android version of code to upload the images in to S3. But i could not find the corresponding APIs in iOS SDK.

 BasicSessionCredentials basiccredentials = new BasicSessionCredentials(
                            MY_ACCESS_KEY_ID, MY_SECRET_KEY,
                            MY_SESSION_TOKEN);
AmazonS3Client s3Client = new AmazonS3Client(
                            basiccredentials);
TransferManager manager = new TransferManager(s3Client);
PutObjectRequest por = new PutObjectRequest(Constants.getPictureBucket(), Constants.PICTURE_NAME,file name);
 manager.upload(por);

iOS SDK has the following CredentialsProvider classes

  1. AWSCognitoCredentialsProvider
  2. AWSStaticCredentialsProvider
  3. AWSWebIdentityCredentialsProvider

AWSStaticCredentialsProvider class accepts only accessKey and secretKey. Other 2 classes expects different parameters.

When i use AWSStaticCredentialsProvider with accessKey and secretKey to upload the images, i am getting the following error message

Upload failed: [Error Domain=NSURLErrorDomain Code=-1017 "cannot parse response" UserInfo=0x7f8773f70ee0 {NSUnderlyingError=0x7f8773f4bbb0 "The operation couldn’t be completed. (kCFErrorDomainCFNetwork error -1017.)", NSErrorFailingURLStringKey=https://s3.amazonaws.com/playfiksprofilepictures/429bfd812ea08e706bab868f3cd8b9c6.jpg, NSErrorFailingURLKey=https://s3.amazonaws.com/playfiksprofilepictures/429bfd812ea08e706bab868f3cd8b9c6.jpg, _kCFStreamErrorDomainKey=4, _kCFStreamErrorCodeKey=-1, NSLocalizedDescription=cannot parse response}]

This error message is not clear whether the issue with the credential Provider or something else

Any help is highly appreciated to resolve this issue

Thank you

EDIT

I have used the sample program provided by @user3467204

Here is the output with the error message(The AWS Access Key Id you provided does not exist in our records). But with the same key, android java code works fine.

Android code uses accessKey,secrectKey and sessionToken, but iOS code uses only accessKey and secrectKey.

2015-06-01 19:42:55.747 AWSV2Test[2191:170157] Image is at /Users/jpsasi/Library/Developer/CoreSimulator/Devices/E846AC10-82BE-40AA-BB7E-29796A8FAD2B/data/Containers/Bundle/Application/B59E9032-306D-4609-97D6-6C516638463A/AWSV2Test.app/testimage.png 2015-06-01 19:42:56.841 AWSV2Test[2191:170157] Uploaded 32677 / 35516 bytes 2015-06-01 19:42:56.842 AWSV2Test[2191:170157] Uploaded 35516 / 35516 bytes 2015-06-01 19:42:56.843 AWSV2Test[2191:170157] Uploaded 35516 / 35516 bytes 2015-06-01 19:43:00.249 AWSV2Test[2191:170157] Uploaded 32677 / 35516 bytes 2015-06-01 19:43:00.250 AWSV2Test[2191:170157] Uploaded 35516 / 35516 bytes 2015-06-01 19:43:00.251 AWSV2Test[2191:170157] Uploaded 35516 / 35516 bytes 2015-06-01 19:43:02.848 AWSV2Test[2191:170157] Uploaded 32677 / 35516 bytes 2015-06-01 19:43:02.849 AWSV2Test[2191:170157] Uploaded 35516 / 35516 bytes 2015-06-01 19:43:02.850 AWSV2Test[2191:170157] Uploaded 35516 / 35516 bytes 2015-06-01 19:43:05.285 AWSV2Test[2191:170157] Uploaded 32677 / 35516 bytes 2015-06-01 19:43:05.286 AWSV2Test[2191:170157] Uploaded 35516 / 35516 bytes 2015-06-01 19:43:05.287 AWSV2Test[2191:170157] Uploaded 35516 / 35516 bytes 2015-06-01 19:43:06.681 AWSV2Test[2191:170157] error => Error Domain=com.amazonaws.AWSS3ErrorDomain Code=3 "The operation couldn’t be completed. (com.amazonaws.AWSS3ErrorDomain error 3.)" UserInfo=0x7faea40171d0 {HostId=GeMapgMjrv43TZ4yFKmTjIw6EsZafbgk3GH9ATtbgIj1VpNNv6EjhmZhobHVm+/2, Message=The AWS Access Key Id you provided does not exist in our records., AWSAccessKeyId=ASIAIFYM7NXH3CSNXY3Q, Code=InvalidAccessKeyId, RequestId=653371138733BE48}

8
  • can you post your code how you are using AWSStaticCredentialsProvider ? Jun 1, 2015 at 12:19
  • i have done same with the AWSStaticCredentialsProvider from here : dropbox.com/s/87ngdsnsgshovzt/awsv2test.tar.gz?dl=0 and it is working fine. Jun 1, 2015 at 12:20
  • @user3467204 Thank you for the sample program. i updated the post with the output of the sample program you have provided. at least i am getting meaning error, but still i am not sure, whether i am using the right API. as i have 3 keys where as iOS program uses only the 2 keys.
    – jpsasi
    Jun 1, 2015 at 14:20
  • IAM user credentials have 2 parts: an access key and a secret key. Temporary STS credentials have 3 parts: an access key, a secret key, and a session token. You appear to be using the the access key and secret key from STS credentials but are not providing the session token, hence the InvalidAccessKeyId failure. Also see aws.amazon.com/articles/4617974389850313 for an iOS example using STS/WIF credentials.
    – jarmod
    Jun 1, 2015 at 14:31
  • @jarmod Thank you for clarifying that i have Temporary STS (3 part credentials). The links which you have provided is pointing to the code snippet which uses the old AWS API. I am finding it difficult to identify the correct API to use the STS 3 Part credentials.
    – jpsasi
    Jun 1, 2015 at 15:35

1 Answer 1

5

If you want to use temporary credentials generated on your server, you need to implement your own credentials provider. I recommend the following approach:

  1. Generate the access key, secret key, and session token on your server. You have many language options including Java, .NET, PHP, Ruby, Python, and Node.js.
  2. Implement your credentials provider by conforming to AWSCredentialsProvider. Take a look at the implementations of AWSWebIdentityCredentialsProvider and AWSCognitoCredentialsProvider as examples. This credentials provider should:
    • Retrieve the access key, secret key, and session key from your server.
    • Persist them locally until they expire.
    • Return the credentials when requested.
    • Re-retrieve them from your server if they are expired.
    • Initiate the credentials refreshing process when - refresh is called.

I encourage you to take a look at Amazon Cognito Identity. With Amazon Cognito, you can create unique end user identifiers for accessing AWS cloud services by using public login providers such as Amazon, Facebook, Google, and any OpenID Connect compatible provider, or by using your own user identity system. It covers many of the custom credentials provider use cases, and it is easier to use and manage.

7
  • 1
    Thank you for the detail. Let me try by implementing my own CredentialProvider.
    – jpsasi
    Jun 1, 2015 at 18:55
  • @jpsasi Implementing a CredentialProvider would be a good technical exercise but unless you actually need to do it because you have a custom requirement then Cognito is probably going to be the better approach.
    – jarmod
    Jun 5, 2015 at 13:53
  • @jarmod it is a client project, I don't have any control over to choose cognito. They are providing the temporary credentials through REST API to upload the images.
    – jpsasi
    Jun 5, 2015 at 14:22
  • @jpsasi Did you end up implementing your own AWSCredentialProvider? Is this required due to the lack of a "refresh" implementation on the AWSStaticCredentialsProvider? I am getting the same error using the AWSStaticCredentialsProvider which the keys are generated on my API server. Jul 25, 2015 at 19:50
  • No. I have tried by implementing own provider. But it did not work. So I had convinced my client to use Congnito and implemented the same. It works now.
    – jpsasi
    Jul 26, 2015 at 1:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.