Access Denied when trying to download a picture from the aws s3 bucket

Question

I tried using AWSS3transferutility to download photos from the aws s3 bucket and display them on my imageView in an ios app, however, when it gives me an access denied error. I am sure the bucket is open to the public and I set up cognito, so I have no idea why this is occurring does anyone have an idea?

func getPicture() {
        let tranferUtility = AWSS3TransferUtility.default()
        let expression = AWSS3TransferUtilityDownloadExpression()

        tranferUtility.downloadData(fromBucket: bucket, key: self.currentQuestionData!._userId!, expression: expression){ (task, url, data, error) in
            if error != nil{
                print(error!)
            }
            DispatchQueue.main.async(execute: {
                self.imageView.image = UIImage(data: data!)
            })

        }
    }


//bucket policy
{
    "Id": "Policy1562706569188",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1562706565258",
            "Action": "s3:*",
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::schooled-deployments-mobilehub-969166170",
            "Principal": "*"
        }
    ]
}

The error message displayed in the console is

"Error Domain=com.amazonaws.AWSS3TransferUtilityErrorDomain Code=2 "(null)" UserInfo={Server=AmazonS3, Error={ Code = AccessDenied; HostId = "GHIlY6U4nxxqKQ/Bn8lf3FWjFZZmVhxn3DDjc8YUZY2gkguT6qdqhS54PL85AL7KaSU0Q9gSckw="; Message = "Access Denied"; RequestId = EA34AC42C00AE399;"

403 is always a permission error, even if bucket is public but if request is coming from an IAM role (assume), the role should have S3 permission. — James Dean
What do you mean by "bucket is public"? Can you edit your question to show us the Bucket Policy? — John Rotenstein
@JohnRotenstein my bucket policy is empty, but I have not blocked public access. Do I need to have a bucket policy? — Omar Dadabhoy

John Rotenstein John Rotenstein · Accepted Answer · 2019-07-09T22:36:44

Some operations are performed on the bucket, while other operations are performed at the object level.

Replace this line:

"Resource": "arn:aws:s3:::schooled-deployments-mobilehub-969166170",

with this:

"Resource": [
    "arn:aws:s3:::schooled-deployments-mobilehub-969166170",
    "arn:aws:s3:::schooled-deployments-mobilehub-969166170/*"
]

That will permit access to the objects.

Access Denied when trying to download a picture from the aws s3 bucket

2 Answers