Getting Access Denied. Please make sure the user attached to the access key has access to assets.project.com

Getting the following error:

manager.project.com/s3-website-us-west-1.amazonaws.com says:

Access Denied. Please make sure the user attached to the access key has access to assets.project.com.

I’ve found a similar issue (https://github.com/ChrisZieba/dodgercms/issues/3) but the solution didn’t resolve it for me.

Here are the steps that I took:

Setup data.project.com

Created data.project.com S3 bucket:

aws s3api create-bucket --bucket data.project.com --region us-west-1 --create-bucket-configuration LocationConstraint=us-west-1

Create data-cors.json:

{
  "CORSRules": [
    {
      "AllowedOrigins": ["*"],
      "AllowedHeaders": ["*"],
      "AllowedMethods": ["HEAD", "GET", "PUT", "POST", "DELETE"],
      "ExposeHeaders": ["ETag", "x-amz-meta-title", "x-amz-meta-label"]
    }
  ]
}

Edited data.project.com CORS:

aws s3api put-bucket-cors --bucket data.project.com --cors-configuration file://~/data-cors.json

Setup assets.project.com

Created assets.project.com S3 bucket:

aws s3api create-bucket --bucket assets.project.com --region us-west-1 --create-bucket-configuration LocationConstraint=us-west-1

Create assets-policy.json:

{
   "Statement": [
      {
         "Effect": "Allow",
         "Principal": "*",
         "Action": "s3:GetObject",
         "Resource": "arn:aws:s3:::assets.project.com/*"
      }
   ]
}

Edited assets.project.com policy

aws s3api put-bucket-policy --bucket assets.project.com --policy file://~/assets-policy.json

Create assets-cors.json:

{
  "CORSRules": [
    {
      "AllowedOrigins": ["*"],
      "AllowedHeaders": ["*"],
      "AllowedMethods": ["HEAD", "GET", "PUT", "POST", "DELETE"],
      "ExposeHeaders": ["ETag"]
    }
  ]
}

Edited assets.project.com CORS:

aws s3api put-bucket-cors --bucket assets.project.com --cors-configuration file://~/assets-cors.json

Setup project.com

Created project.com S3 bucket:

aws s3api create-bucket --bucket project.com --region us-west-1 --create-bucket-configuration LocationConstraint=us-west-1

Configure bucket as a website

aws s3 website s3://project.com/ --index-document index.html --error-document error.html

Create web-policy.json:

{
   "Statement": [
      {
         "Effect": "Allow",
         "Principal": "*",
         "Action": "s3:GetObject",
         "Resource": "arn:aws:s3:::datacoral.io/*"
      }
   ]
}

Edited project.com policy

aws s3api put-bucket-policy --bucket project.com --policy file://~/web-policy.json

Create web-cors.json:

{
  "CORSRules": [
    {
      "AllowedOrigins": ["*"],
      "AllowedHeaders": ["*"],
      "AllowedMethods": ["HEAD", "GET", "PUT", "POST", "DELETE"],
      "ExposeHeaders": ["ETag", "x-amz-meta-title", "x-amz-meta-label"]
    }
  ]
}

Edited project.com CORS:

aws s3api put-bucket-cors --bucket project.com --cors-configuration file://~/web-cors.json

Setup manager.project.com

Created manager.project.com S3 bucket:

aws s3api create-bucket --bucket manager.project.com --region us-west-1 --create-bucket-configuration LocationConstraint=us-west-1

Configure bucket as a website

aws s3 website s3://manager.project.com/ --index-document index.html --error-document error.html

Uploaded files to manager.project.com

aws --profile dccustomer s3 sync ~/dodgercms s3://manager.project.com/ --acl public-read

Created a user with the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1427944232000",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:PutObject",
                "s3:GetBucketWebsite",
                "s3:PutBucketWebsite",
                "s3:DeleteBucketWebsite",
                "s3:GetBucketLogging",
                "s3:GetBucketVersioning",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::data.project.com",
                "arn:aws:s3:::data.project.com/*",
                "arn:aws:s3:::assets.project.com",
                "arn:aws:s3:::assets.project.com/*",
                "arn:aws:s3:::project.com",
                "arn:aws:s3:::project.com/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "sts:GetFederationToken",
            "Resource": "*"
        }
    ]
}

[tomsaleeba]

It might be because your bucket isn’t in the us-east-1 zone. If you know how to open the dev tools in your browser, do so when you try to login and if you the OPTIONS calls to s3 are returning a 301 HTTP reponse status (not a 200) then this could be the reason.

I noticed someone else has had to change the code to use a different region: https://github.com/peter-mount/dodgercms/commit/333a695b410489b86083ffb1f9fcf749dfc95ade. I’ve gone through the same issue and made the same change and it works. Although it’s late, so hopefully I’ve diagnosed it right.

[Fluffy9]

Same issue