AWSS3GetPreSignedURLRequest upload with custom headers giving 403

Question

I've been having some problems with my AWSS3GetPreSignedURLRequest and AFNetworking's NSMutableURLRequest. I can successfully upload a file with just the Content-Type header. However, if I add the x-amz-acl and the x-amz-server-side-encryption , the upload will fail with 403 - No Permission error. What can I do? Is it an Amazon side problem, using server-side encryption or ACLs isn't allowed with pre-signed URLs, or changing the request will work? I looked pretty deep on the AWS documentation and the iOS SDK reference, but nothing on this. By the way, I'm using AWS iOS SDK v2. Does anyone how how to do this?

    NSString *keyName;
    NSString *fileContentTypeStr;
    NSDateFormatter *formatter = [[NSDateFormatter alloc] init];
    [formatter setDateFormat:@"MM.d.h.mm.ss"];
    if([multipleFileType isEqualToString:@"PNG"])
    {
        fileContentTypeStr = @"image/png";
        keyName = [NSString stringWithFormat:@"image_%@.png", [formatter stringFromDate:[NSDate date]]];
    }
    else if([multipleFileType isEqualToString:@"JPG"])
    {
        fileContentTypeStr = @"image/jpeg";
        keyName = [NSString stringWithFormat:@"image_%@.jpg", [formatter stringFromDate:[NSDate date]]];
    }
    self.imageUploadURL = [NSURL fileURLWithPath:[NSTemporaryDirectory() stringByAppendingPathComponent:@"image"]];

    [imageData writeToURL:self.imageUploadURL atomically:YES];
    AWSS3GetPreSignedURLRequest *getPreSignedURLRequest = [AWSS3GetPreSignedURLRequest new];
    getPreSignedURLRequest.bucket = [NSString stringWithFormat:@"BUCKET-NAME/%@",  folderObject.objectId];
    getPreSignedURLRequest.key = keyName;
    getPreSignedURLRequest.HTTPMethod = AWSHTTPMethodPUT;
    getPreSignedURLRequest.expires = [NSDate dateWithTimeIntervalSinceNow:3600];
    getPreSignedURLRequest.contentType = fileContentTypeStr;

    [[[AWSS3PreSignedURLBuilder defaultS3PreSignedURLBuilder] getPreSignedURL:getPreSignedURLRequest]
     continueWithBlock:^id(BFTask *task) {
         if (task.error) {
             NSLog(@"Error: %@",task.error);
         } else {
             NSURL *presignedURL = task.result;
             NSMutableURLRequest *URLRequest = [NSMutableURLRequest requestWithURL:presignedURL];
             [URLRequest setValue:fileContentTypeStr forHTTPHeaderField:@"Content-Type"];
             [URLRequest setValue:@"AES-256" forHTTPHeaderField:@"x-amz-server-side-encryption"];
             [URLRequest setValue:@"private" forHTTPHeaderField:@"x-amz-acl"];
             URLRequest.HTTPMethod = @"PUT";
             URLRequest.HTTPBody = imageData;

             AFURLSessionManager *manager = [[AFURLSessionManager alloc] initWithSessionConfiguration:[NSURLSessionConfiguration defaultSessionConfiguration]];
             NSProgress *progress;
             NSURLSessionUploadTask *uploadTask = [manager uploadTaskWithStreamedRequest:URLRequest progress:&progress completionHandler:^(NSURLResponse *response, id responseObject, NSError *error) {
             if(!error){
             NSLog(@"File was successfully uploaded.");
             }
             }];
             [uploadTask resume];
         }
         return nil;
     }];

Note: The code sample there lacks a few things that are on the global headers, and a few other completion blocks + delegates, but I believe everyone will understand the point here.

Anticipated thanks,

Answer 1

As @YosukeMatsuda noticed in comments you can use putObjectAcl: method.

I put ACL for uploaded object on URLSession didCompleteWithError: delegate method like this:

//
self.awss3 = [[AWSS3 alloc] initWithConfiguration:__your_config__];
//

- (void)URLSession:(NSURLSession *)session task:(NSURLSessionTask *)task didCompleteWithError:(NSError *)error
{
    if (error)
    {
        NSLog(@"S3 UploadTask: %@ completed with error: %@", task, [error localizedDescription]);
    }
    else
    {
//      AWSS3GetPreSignedURLRequest does not contain ACL property, so it has to be set after file was uploaded to bucket
        AWSS3PutObjectAclRequest *aclRequest = [AWSS3PutObjectAclRequest new];
        aclRequest.bucket = @"your_bucket";
        aclRequest.key = @"your_key";
        aclRequest.ACL = AWSS3ObjectCannedACLPublicRead;

        [[self.awss3 putObjectAcl:aclRequest] continueWithBlock:^id(BFTask *bftask) {
            if (bftask.error)
            {
                NSLog(@"Error putObjectAcl: %@", [bftask.error localizedDescription]);
            }
            else
            {
                AWSEndpoint *endpoint =  self.awss3.configuration.endpoint;
                NSURL *publicReadURL = [[endpoint.URL URLByAppendingPathComponent:backgroundUploadTask.bucket] URLByAppendingPathComponent:backgroundUploadTask.key];
            }
            return nil;
        }];
    }
}

Answer 2

We added - setValue:forRequestParameter: to AWSS3GetPreSignedURLRequest . You can use this method to add ACL and encryption headers.

Also, we introduced a new AWSS3TransferUtility for simplifying the background transfer. Refer to our blog post for more details.