如何在放入S3预签名URL时修复'403 Forbidden'

Question

I am trying to put an image onto an S3 bucket using a presigned url. I'm using SAM to host the site locally and the PUT request works correctly. However when running the command on my prod server I get a '403 Forbidden' error.

Worth noting the OPTIONS request works fine, get 200 code, but next when the PUT is sent get 403 code.

Things I have already tried:

• Tried setting the content type as my image type
• Tried putting header content type in
• Tried setting the COMS to allow GET, POST, PUT, DELETE
• Tried setting the access for my lambda role to have admin access

Nothing worked still get '403 Forbidden'

JQuery Ajax:

$.ajax({
    url: presignedUrl,
    type: 'PUT',
    data: image,
    contentType: image.type,
    processData: false,
    success: function (response) {
        // window.location = '/Prod/';
    }
});

Creating presigned url:

$cmd = $this->client->getCommand('PutObject', [
    'Bucket' => env('AWS_BUCKET'),
    'Key' => 'images/' . $request->input('image_name'),
]);

return $this->client->createPresignedRequest($cmd, '+20 minutes')->getUri();

General from '403 Forbidden':

Request Method: PUT
Status Code: 403 Forbidden
Referrer Policy: no-referrer-when-downgrade

Response Headers from '403 Forbidden':

Access-Control-Allow-Methods: GET, POST, PUT, HEAD
Access-Control-Allow-Origin: *
Connection: close
Content-Type: application/xml
Date: Wed, 15 May 2019 15:02:35 GMT
Server: AmazonS3
Transfer-Encoding: chunked
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-id-2: e5WZfJAQk24kl7kBoF+HU8+AOiR7ivTIcUZ71dZl0Ssged03RThlCRtku+AmhRRUwFe1p63cL4Q=
x-amz-request-id: 4767484BEBE4EC07

Request Headers from '403 Forbidden':

Accept: */*
Content-Type: image/jpeg
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36

Locally the put request works correctly and has no errors.

Answer 1

Eventually fixed the issue.

I had specified the credentials in the S3 Client, removing them allowed the role of the lambda function to access S3 correctly.

Incorrect:

        $this->client = new S3Client([
            'credentials' => [
                'key'    => env('AWS_ACCESS_KEY_ID'),
                'secret' => env('AWS_SECRET_ACCESS_KEY'),
            ],
            'region' => env('AWS_DEFAULT_REGION'),
            'version' => 'latest',
        ]);

Correct:

        $this->client = new S3Client([
            'region' => env('AWS_DEFAULT_REGION'),
            'version' => 'latest',
        ]);