使用 generatePresignedPutUrl 时，Amazon S3 返回拒绝访问

Question

I am trying to upload files with NodeJS to Amazon S3 in a private bucket but when I send the put request, AWS returns access denied and I don't understand why since the url has been generated through a generatePresignedPutUrl.

Here is the bucket configuration in spanish but it just has all the protection boxes checked.

Next I leave AWS configuration code in nodeJS:

import AWS from 'aws-sdk';

const bucketName = 'atlasfitness-progress';
const region =process.env.AWS_REGION;
const accessKeyId = process.env.AWS_ACCESS_KEY
const secretAccessKey = process.env.AWS_SECRET_KEY

const s3 = new AWS.S3({
    region,
    accessKeyId,
    secretAccessKey,
    signatureVersion: 'v4'
})

export const generatePreSignedPutUrl = async (fileName, fileType) => {

    const params = ({
        Bucket: bucketName,
        Key: fileName,
        Expires: 1000
    })

    try {
        const url = await s3.getSignedUrlPromise('putObject', params);
        return url;
    } catch (err) {
        console.log(err);
        return
    }

}

Then I use curl with an image to the url generated by the generatePreSignedUrl

curl -X PUT -T name_image "url_generated_by_NodeJS_Code"

But the response I get is the following:

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>CY87GFMPFE94HR3J</RequestId><HostId>PgvNz4AiH2C5Rtfb9ZvfY24ybqX3qGM/V9R81GgjEUDVikkNnqOkM/uWn+Q9+zRWKEaj0bMK0Qs=</HostId></Error>

If anyone knows what may be happening or how to solve it please let me know, thank you very much.

Answer 1

TL;DR - verify that the role/user you are using to generate the presigned URL has putObject permission to the bucket.

The presigned URL has the encoded credentials of who generated the URL. When the object arrives to S3, the service decode the credentials and check the policy assigned to those credentials. Therefore if those credentials won't have the right permissions on the bucket, the access will be denied.

Another option is that your session has expired by the time your request arrives to S3 (relevant in case you are using IAM role).