20

I have established an AWS acct. and am trying to do my first programmatic PUT into S3. I have used the console to create a bucket and put things there. I have also created a subdirectory (myFolder) and made it public. I created my .aws/credentials file and have tried using the sample codes but I get the following error:

Error executing "PutObject" on "https://s3.amazonaws.com/gps-photo.org/mykey.txt"; AWS HTTP error: Client error: PUT https://s3.amazonaws.com/gps-photo.org/mykey.txt resulted in a 403 Forbidden response: AccessDeniedAccess DeniedFC49CD (truncated...) AccessDenied (client): Access Denied - AccessDeniedAccess DeniedFC49CD15567FB9CD1GTYxjzzzhcL+YyYsuYRx4UgV9wzTCQJX6N4jMWwA39PFaDkK2B9R+FZf8GVM6VvMXfLyI/4abo=

My code is

<?php

// Include the AWS SDK using the Composer autoloader.
require '/home/berman/vendor/autoload.php';
use Aws\S3\S3Client;
use Aws\S3\Exception\S3Exception;
$bucket = 'gps-photo.org';
$keyname = 'my-object-key';
// Instantiate the client.
$s3 = S3Client::factory(array(
    'profile' => 'default',
    'region' => 'us-east-1',
    'version' => '2006-03-01'
));
try {
    // Upload data.
    $result = $s3->putObject(array(
        'Bucket' => $bucket,
        'Key'    => "myFolder/$keyname",
        'Body'   => 'Hello, world!',
        'ACL'    => 'public-read'
    ));
    // Print the URL to the object.
    echo $result['ObjectURL'] . "\n";
} catch (S3Exception $e) {
    echo $e->getMessage() . "\n";
}

If anyone can help me out, that would be great. Thanks. --Len

7 Answers 7

21

It looks like the same issue I ran into. Add a AmazonS3FullAccess policy to your AWS account.

  • Log into AWS.
  • Under Services select IAM.
  • Select Users > [Your User]
  • Open Permissoins Tab
  • Attach the AmazonS3FullAccess policy to the account
1
  • 10
    I wouldn't recommend granting S3FullAccess, that's a bad practice from a security point of view and human error mistakes. you should restrict the policy to the specific bucket you are working with.
    – Broshi
    Dec 7, 2018 at 13:07
17

I facing same problem and found the solution as below.

remove line

'ACL' => 'public-read'

default permission with list, read, and write but without permission for change object specific permission (PutObjectAcl in AWS policy).

2
  • Thank you so much. I was struggling for last 2 days. I was doubting my policy when error was in my code. Jul 27, 2021 at 12:24
  • This solved my problem too. Was following the AWS developer docs and didn't catch that this line was restricting me from writing to the bucket. JSON policy was correct. Feb 5 at 22:52
14

Braden's approach will work, but it is dangerous. The user will have full access to all your S3 buckets and the ability to log into the console. If the credentials used in the site are compromised, well...

A safer approach is:

  1. AWS Console -> IAM -> Policies -> Create policy
  2. Service = S3
  3. Actions = (only the minimum required, e.g. List and Read)
  4. Resources -> Specific -> bucket -> Add ARN (put the ARN of only the buckets needed)
  5. Resources -> Specific -> object -> check Any or put the ARN's of specific objects
  6. Review and Save to create policy
  7. AWS Console -> IAM -> Users -> Add user
  8. Access type -> check "Programmatic access" only
  9. Next:Permissions -> Attach existing policies directly
  10. Search and select your newly created policy
  11. Review and save to create user

In this way you will have a user with only the needed access.

2
6

Assuming that you have all the required permissions, if you are getting this error, but are still able to upload, check the bucket permissions section under your bucket, and try disabling (uncheck) "Block all public access," and see if you still get the error. You can enable this option again if you want to.

This is an extra security setting/policy that AWS adds to prevent changing the object permissions.enter image description here If your app gives you problems or generates the warning, first look at the code and see if you are trying to change any permissions (which you may not want to). You can also customize these settings to better suit your needs.

Again, you can customize this settings by clicking your S3 bucket, permissions/ edit.

2

The 403 suggests that your key is incorrect, or the path to key is not correct. Have you verified that the package is loading the correct key in /myFolder/$keyname?

Might be helpful to try something simpler (instead of worrying about upload filetypes, paths, permissions, etc.) to debug.

$result = $client->listBuckets();
foreach ($result['Buckets'] as $bucket) {
    // Each Bucket value will contain a Name and CreationDate
    echo "{$bucket['Name']} - {$bucket['CreationDate']}\n";
}

Taken from http://docs.aws.amazon.com/aws-sdk-php/v2/guide/service-s3.html Also check out the service builder there.

2
  • I checked the aws_access_key_id and it is correct. I tried the simplified request you gave above and got the same error. I don't know how to check whether the secret key is correct, but since it was done with cut&paste I see no reason to suspect that it is incorrect. Looks like a configuration issue to me.
    – LenB
    Dec 24, 2015 at 20:23
  • Have you tried to simply file_get_contents and echo the key? You're loading it currently from myFolder/my-object-key. Is that the correct path? You should be able to print_r(file_get_contents('myFolder/my-object-key')) The issue isn't necessarily the key is incorrect (however you'd be surprised that copy & paste can often yield incorrect characters if you're not safe), it's that the path to the key is probably incorrect.
    – Denault
    Dec 29, 2015 at 17:14
2

The problem was a lack of permissions on the bucket themselves once I added those everything worked fine.

1
  • 1
    Same error, this fails to clarify. The bucket is readable, is S3FullAccess not enough?
    – Kzqai
    Oct 19, 2017 at 21:17
1

I got the same error issue. Project is laravel vue, I'm uploading file using axios to s3.

I'm using vagrant homestead as my server. Turns out the time on the virtual box server is not correct. I had to update it with the correct UTC time. After updating to correct time which I took from the s3 error it worked fine.

Error: I have removed sensitive information

message: "Error executing "PutObject" on "https://url"; AWS HTTP error: Client error: `PUT https://url` resulted in a `403 Forbidden` response:↵<?xml version="1.0" encoding="UTF-8"?>↵<Error><Code>RequestTimeTooSkewed</Code><Message>The difference between the reque (truncated...)↵ RequestTimeTooSkewed (client): The difference between the request time and the current time is too large. - <?xml version="1.0" encoding="UTF-8"?>↵<Error><Code>RequestTimeTooSkewed</Code><Message>The difference between the request time and the current time is too large.</Message><RequestTime>20190225T234631Z</RequestTime><ServerTime>2019-02-25T15:47:39Z</ServerTime><MaxAllowedSkewMilliseconds>900000</MaxAllowedSkewMilliseconds><RequestId>-----</RequestId><HostId>----</HostId></Error>"

Before:

vagrant@homestead:~$ date
Wed Feb 20 19:13:34 UTC 2019

After:

vagrant@homestead:~$ date
Mon Feb 25 15:47:01 UTC 2019

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.