Permission denied

[yannh]

Hey, I created a new private repository, and apt-boto-s3 fails to download the package index, while the AWS cli has no problems with it:

[...] E: Failed to fetch http://s3.eu-central-1.amazonaws.com/MYBUCKET/ubuntu/dists/1234/1234/binary-amd64/Packages 403 Forbidden E: Some index files failed to download. They have been ignored, or old ones used instead.

ubuntu@hostname:~$ aws s3 cp --region eu-central-1 s3://MYBUCKET/ubuntu/dists/1234/1234/binary-amd64/Packages . download: s3://planet-ber-apt/ubuntu/dists/1234/1234/binary-amd64/Packages to ./Packages

Any idea what could be wrong? Does apt-boto-s3 use more permissions than the aws cli? Thanks!

PS: The policy I ve made a bit wider for testing, but still getting 403:

    {
        "Action": [
            "s3:*"
        ],
        "Resource": "arn:aws:s3:::*",
        "Effect": "Allow"
    },
    {
        "Action": [
            "s3:*"
        ],
        "Resource": "arn:aws:s3:::MYBUCKET",
        "Effect": "Allow"
    },
    {
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::MYBUCKET/*"
        ],
        "Effect": "Allow"
    }

[yannh]

Does apt-boto-s3 only works with credentials (access key and private key) - can it assume the machine role as described in http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-api.html ?

Thanks!

[pauldraper]

Hm, try s3-eu-central-1.amazonaws.com rather than s3.eu-central-1.amazonaws.com.

Most regions follow the s3-$region.amazonaws.com pattern. It looks like Frankfurt and Seoul are exception and will accept either. apt-boto-s3 should be changed to accept this.

[yannh]

Hi Paul, thank you for your reply, it took me a long time to figure out, I made a mistake and was hitting S3 with the HTTP transport. Sorry for wasting your time!

[pauldraper]

Ha ha ha ;)