AWS CLI s3 copies with 403 error trying to administer user-loaded object

Question

Attempting to copy a file from the S3 bucket to the local computer:

aws s3 cp s3://my-bucket-name/audio-0b7ea3d0-13ab-4c7c-ac66-1bec2e572c14.wav ./

fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden 

Things I confirmed:

• I am using version aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-75-generic botocore/1.4.70
• The string of the S3 object is correct. I copied it directly from the S3 web interface.
• The AWS CLI is configured with valid credentials. I created a new key / secret pair. I deleted the ~ / .aws folder before re-configuring aws cli. The IAM online web interface confirms that the arn-specific user actually uses S3 through the CLI.
• An IAM user is provided with an S3 full access control policy for this SO message . I deleted all of these user policies, and then added only an AWS managed policy called "AdministratorAccess" that includes "S3, Full Control, All Resources." Is there any other way to provide access through the CLI? I did not believe in that.

The bucket policy is designed to provide wide open access:

    {
        "Sid": "AdminAccess",
        "Effect": "Allow",
        "Principal": "*",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::my-bucket-name",
            "arn:aws:s3:::my-bucket-name/*"
        ]
    }

How did I upload this object?

I downloaded this object using the AWS Signature v4 subscription download policy from a web application in the client browser directly in AWS.

Answer 1

, , , OBJECT "", "" .

, ( ). . "" , GET -. , . S3 , .

, POST'ed , "".

acl=bucket-owner-full-control, . , "", () , AWS CLI.

, acl=ec2-bundle-read AWS SDK. . https://github.com/aws/aws-sdk-java/blob/7844c64cf248aed889811bf2e871ad6b276a89ca/aws-java-sdk-ec2/src/main/java/com/amazonaws/services/ec2/util/S3UploadPolicy.java#L77

S3UploadPolicy.java (, , ) , acl=bucket-owner-full-control. , AWS CLI.

Answer 2

AWS S3 Forbidden (403), . , s3 .

Answer 3

s3 , . , bucket , . . .

Answer 4

, , S3, , . .

Answer 5

3 (A1, A2, A3) 3 (canonical_user_account_A1, canonical_user_account_A2, canonical_user_account_A3) 1 IAM (R1), A3.

A2 canonical_user_account_A1 ( ). , , , ,

fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden

I added the resolution Listand Getfor R1politics basket and resolutions role in this case that's not enough, if the account in which a bucket is not the owner, can not afford to users from another account get(download) files. So I needed to make sure that when downloading files I use:

    access_control_policy = {
    'Grants': [
        {
            'Grantee': {
                'ID': canonical_user_account_A2,
                'Type': 'CanonicalUser'
            },
            'Permission': 'READ'
        },
        {
            'Grantee': {
                'ID': canonical_user_account_A3,
                'Type': 'CanonicalUser'
            },
            'Permission': 'READ'
        },
    ],
    'Owner': {
        'ID': canonical_user_account_A1
    }
}

upload_extra_args = {'ACL': 'bucket-owner-full-control'}

s3_client.upload_file(file_path, bucket_name, s3_file_path, ExtraArgs=upload_extra_args)

s3_client.put_object_acl(AccessControlPolicy=access_control_policy, Bucket=bucket_name, Key=s3_file_path)

This allows both canonical_user_account_A2and canonical_user_account_A3read and download the file.