Chef aws client

Question

I don't quite figure out how to use this aws cookbook . My goal is to download some file from my s3 bucket. According to documentation , I've set this content in my recipe:

aws = data_bag_item('aws', 'dev')

aws_s3_file '/tmp/authz.war' do
  bucket 'living-artifacts-dev'
  remote_path '/authz/authz.war'
  aws_access_key aws['aws_access_key_id']
  aws_secret_access_key aws['aws_secret_access_key']
  region 'eu-central-1'
end

All values are populated correctly and I've also tried to test them using aws-cli. Nevertheless, chef client is getting this message:

=========================================================================
Error executing action `create` on resource 'aws_s3_file[/tmp/authz.war]'
=========================================================================

Net::HTTPServerException
------------------------
remote_file[/tmp/authz.war] (/var/chef/cache/cookbooks/aws/providers/s3_file.rb line 40) had an error: Net::HTTPServerException: 403 "Forbidden"

How could I debug this?

EDIT

I've tested it using aws command client. I've firstly set credentials using aws configure and I've provided requested values. So, this command:

aws s3 cp s3://living-artifacts-dev/authz/authz.war authz.war

is correctly performed and file is downloaded.

EDIT

More detailed error message:

==> default:   * aws_s3_file[/tmp/authz.war] action create
==> default:
==> default:     * chef_gem[aws-sdk] action install
==> default: [2017-03-03T11:25:16+00:00] INFO: chef_gem[aws-sdk] installed aws-sdk at ~> 2.2
==> default:
==> default:       - install version ~> 2.2 of package aws-sdk
==> default: [2017-03-03T11:25:16+00:00] INFO: Remote and local files do not match, running create operation.
==> default:     * chef_gem[aws-sdk] action install (up to date)
==> default:     * remote_file[/tmp/authz.war] action create
==> default: [2017-03-03T11:25:16+00:00] INFO: HTTP Request Returned 403 Forbidden:
==> default: [2017-03-03T11:25:16+00:00] WARN: remote_file[/tmp/authz.war] cannot be downloaded from https://living-artifacts-dev.s3.e
u-central-1.amazonaws.com/authz/authz.war?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=sFo6JjohgYi%2BYi4Ut7pTy9EGVDCG89IROX%2Bw7E
RR%2F20170303%2Feu-central-1%2Fs3%2Faws4_request&X-Amz-Date=20170303T112516Z&X-Amz-Expires=300&X-Amz-SignedHeaders=host&X-Amz-Signatur
e=f3c2b371ad4e1fe24745459adf0463c708e0363a139b598b04e40789c43ded7d: 403 "Forbidden"

Answer 1

Remove the first slash from remote_path '/authz/authz.war'

Here is the example from the AWS cookbook documentation :

aws_s3_file '/tmp/foo' do
  bucket 'i_haz_an_s3_buckit'
  remote_path 'path/in/s3/bukket/to/foo'
  aws_access_key aws['aws_access_key_id']
  aws_secret_access_key aws['aws_secret_access_key']
  region 'us-west-1'
end

Answer 2

You have a forbidden error

 403 "Forbidden"

You need to ensure your system if on AWS has an appropriate IAM policy attached to it which has at least READ on the bucket and specifically the file you need.