Upload file to S3 on EC2 instance - permission denied

Question

So in my app, users will be able to upload their photos to S3 storage, then I will persist the returned Url to database.

The problem that I am having is that, when I deploy the app to my Elastic Beanstalk environment, I am not able to store photos to S3 storage anymore due to this error which I found in the catalina.out log:

java.io.IOException: Permission denied
    at java.io.UnixFileSystem.createFileExclusively(Native Method)
    at java.io.File.createNewFile(File.java:1012)
    at com.common.util.file.FileUtil.convert(FileUtil.java:17)

How can I set permission so that I can fix this bug?

[EDIT] When I run the app on the localhost, then I will be able to upload the file into the S3 bucket. I used this sample code in this link as implementation template for uploading the file.

Here is the code that I use to convert a multipart file to a file:

public File convert(MultipartFile file) throws IOException {
    File convFile = new File(file.getOriginalFilename());
    convFile.createNewFile();                               // Cause IOException
    FileOutputStream fos = new FileOutputStream(convFile);
    fos.write(file.getBytes());
    fos.close();
    return convFile;
}

Answer 1

In your application, don't append the aws credentials. Create an IAM role which should have permission for AWS S3. When launching application using Elastic Beanstalk, attach this IAM role to an EC2 Instance.

Your application uses IAM role to authenticate AWS S3 to upload the images. It is a best practices to attach IAM role with specific permission for launching EC2 instance through AutoScaling group or Elastic Beanstalk or directly from EC2 dashboard.

Answer 2

The link to the sample code you provided uses ProfileCredentialsProvider , which vends AWSCredentials from the profile configuration file for the default profile ( read more ).

You'll need to either (1) copy the config file from your local machine to the EC2 instance or (2) use another method to supply AWS credentials to the SDK. See Working with AWS Credentials , for example.