403 prohibited for AWS Beanstalk Flask static files without SSL

Question

My local machine is a virtual CeontOS-7 with a Python 2.7 virtual file containing the Flask application directory, the structure is as follows:

/var /www /myAppenv /myApp /.ebextensions myApp-env.config /.elasticbeanstalk application.py requirements.txt /flaskApp /core views.py models.py forms.py /templates /static 

and I am deploying it from / myApp using the EB CLI deployment to a Beanstalk application named myApp with an environment named myApp-env.

I think the path of the static files is set directly in /.ebextensions/myApp-env.config:

 option_settings: "aws:elasticbeanstalk:container:python:staticfiles": "/static/": "flaskApp/static/" 

and I see in the AWS web console-> environment-> Configurations-> Software Configuration, which

 StaticFiles: /static/=flaskApp/static/ 

therefore, setting the path is not the cause of the problem.

Therefore, when I open a web page for my application, I see that the page is missing css and js, since everything from the static directory receives a forbidden 403 response:

 GET http://myApp-dev.elasticbeanstalk.com/ [HTTP/1.1 200 OK 174ms] GET http://myApp-dev.elasticbeanstalk.com/static/bootstrap-3.3.5-dist/js/bootstrap.min.js [HTTP/1.1 403 Forbidden 55ms] ... 

Guessing something about permissions, because my linux account belongs to my local repository files (for samba reasons), then I tried to use the root root and chgrp root (static permissions for files and files 755), but this is not so, do not change anything. Actually, I don’t think this is due to the / selinux firewall, the fact that the main page is loading.

Does anyone know how to solve this problem?

Answer 1

The root owner / group may not be relevant if the files cannot be viewed by all users. Make sure they are accessible to everyone by running chmod 664 for all static files.

Answer 2

I think I found the problem. I studied EB SSH to understand what was happening, and I noticed that the "ec2 user" that I got on the AWS machine could access (execute the cd command) to the directory

 /opt/python/current/app 

but the ec2 user did not allow access to dir

 /opt/python/current/app/flaskApp 

due to permissions.

Although the static dirs and files contained in flaskApp still had permissions set to 755, I noticed that flaskApp dir (which contains the static directory) is 744 (which I think will be fine). Thus, I changed the permissions of flaskApp dir to 755, and it worked: now static files load!

By the way, I doubt that this set of permissions is good for production. An alternative would be to structure dirs, so static is not a subdirectory of flaskApp dir, allowing this method to keep the static set of dir set to 755, with the flaskApp set for more conservative permissions.