Proper syntax for AWS S3 php-sdk "putObjectAcl"

Question

I've been tasked with figuring out how the AWS PHP sdk works so we can possibly use it for hosting customer image data for our web server. I've been able to successfully test most of the functionality of creating, managing and loading data into a bucket, but when I try to view the contents I get 'access denied'.

Going into the management console, I figured out how to set the permissions so I could view the file, either with a specific host rule or by setting both the bucket and the object world-readable.

However, no matter how I try following the examples in the PHP sdk [limited] documentation, I cannot seem to set the ACL values using the php code provided by Amazon.

Their examples just list in the place of the various value and I have tried filling in the relevant data for my bucket, object and account in those and it doesn't work. I've tried doing a getObjectAcl and sending back something similar to what was received and it doesn't work. I've tried looking at examples on-line and what little I have found doesn't work.

Here's an example of the latest I have tried:

$params = [
    'ACL' => 'public-read',
    'AccessControlPolicy' => [
        'Grants' => [
            [
                'Grantee' => [
                    'DisplayName' => 'Owner',
                    'ID' => $awsId,
                    'Type' => "CanonicalUser"
                ],
                'Permission' => "FULL_CONTROL"
            ],
            [
                'Grantee' => [
                    'DisplayName' => 'All Users',
                    'URI' => "http://acs.amazonaws.com/groups/global/AllUsers",
                    'Type' => "Group"
                ],
                'Permission' => "READ"
            ],
        ],
        'Owner' => [
            'ID' => $awsId
        ]
    ],
    'Bucket' => "our-test-bucket",
    'Key' => "800x600.jpg"
];

$result = $awsSdk->getS3Client()->putObjectAcl($params);

The resulting output:

Fatal error: Uncaught exception 'Aws\S3\Exception\S3Exception' with message 'Error executing "PutObjectAcl" on "https://our-test-bucket.s3.us-east-2.amazonaws.com/800x600.jpg?acl"; AWS HTTP error: Client error: PUT https://our-test-bucket.s3.us-east-2.amazonaws.com/800x600.jpg?acl resulted in /project/vendor/aws/aws-sdk-php/src/WrappedHttpHandler.php on line 191

Aws\S3\Exception\S3Exception: Error executing "PutObjectAcl" on "https://our-test-bucket.s3.us-east-2.amazonaws.com/800x600.jpg?acl"; AWS HTTP error: Client error: PUT https://our-test-bucket.s3.us-east-2.amazonaws.com/800x600.jpg?acl resulted in a 400 Bad Request response: MalformedACLErrorThe XML you provided was not well-f (truncated...) MalformedACLError (client): The XML you provided was not well-formed or did not validate against our published schema - MalformedACLErrorThe XML you provided was not well-formed or did not validate against our published schemaB24661919936C2DADft/***********************************************= in /project/vendor/aws/aws-sdk-php/src/WrappedHttpHandler.php on line 191

Scott Scott · Accepted Answer · 2019-03-06T16:32:57

I managed to drop a trace into the guzzle html messageTrait withHeader() function so I could watch the outgoing xml in the php stream. I then compared the result with examples of the xml I found in various places in a google search and through trial and error with the comparisons, I traced the problem down to the 'DisplayName' => 'All Users' in the Group Grant. Remove that line and it appears to work.

$pubAcl = [
    'Owner' => [
        'ID' => $awsId,
        'DisplayName' => 'Owner'
    ],
    'Grants' => [
        [
            'Grantee' => [
                'ID' => $awsId,
                'DisplayName' => 'Owner',
                'Type' => "CanonicalUser"
            ],
            'Permission' => "FULL_CONTROL"
        ],
        [
            'Grantee' => [
                'URI' => "http://acs.amazonaws.com/groups/global/AllUsers",
                'Type' => "Group"
            ],
            'Permission' => "READ"
        ]
    ]
];

(The order change was the result of testing but didn't turn out to be the problem)

Proper syntax for AWS S3 php-sdk "putObjectAcl"

1 Answers