Why are my Amazon S3 access rights not supported?

Question

I use the Python boto library to connect to Amazon S3 and create buckets and keys for a static website. My keys and values ​​are dynamically generated, so I do it programmatically, and not through the web interface (it works using the web interface). Currently my code is as follows:

 import boto from boto.s3.connection import S3Connection from boto.s3.key import Key conn = S3Connection(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) bucket = conn.create_bucket(BUCKET_NAME) bucket.configure_website('index.html', 'error.html') bucket.set_acl('public-read') for template in ['index.html', 'contact-us.html', 'cart.html', 'checkout.html']: k = Key(bucket) k.key = key k.set_acl('public-read') k.set_metadata('Content-Type', 'text/html') k.set_contents_from_string(get_page_contents(template)) 

I get various errors and problems with this code. When the keys already existed and I used this code to update them, I would set the ACL of each key in public-read , but when I view the file in the browser, I still get 403 forbidden errors.

I tried to delete all the keys in order to recreate them from scratch, and now I get a NoSuchKey exception. Obviously, there is no key, because I'm trying to create it.

Am I really wrong? Is there any other way to do this to create keys, and not to update them? And am I experiencing some kind of race condition when permissions don't stick?

Answer 1

I'm still not quite sure why the code above does not work, but I found a different (or newer?) Syntax for creating keys. It seems that the order of operations also has some effect. This is what I came up with:

 conn = S3Connection(AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) bucket = conn.create_bucket(store.domain_name) bucket.set_acl('public-read') bucket.configure_website('index.html', 'error.html') for template in ['index.html', 'contact-us.html', 'cart.html', 'checkout.html']: k = bucket.new_key(template) k.set_metadata('Content-Type', 'text/html') k.set_contents_from_string(get_page_contents(template)) k.set_acl('public-read') #doing this last seems to be important for some reason 

Answer 2

It also bit me. The boto set_contents_from_string() method apparently sets the key ACL to private, overriding any existing ACL.

So, if you do set_acl('public-read') and then set_contents_from_string() , 'public-read' will be overridden.

Answer 3

I managed to set the ACL at a time using the policy arg keyword:

 k.set_contents_from_stream(buff, policy='public-read')