Get Error: 403

[betonetotbo]

I'm trying to download an object of my S3 bucket. This is the code:

procedure TForm1.Button1Click(Sender: TObject);
var
  objs: IS3Objects;
  obj: IS3Object;
begin
  objs := TS3Service.New(
    TAWSClient.New(
      TAWSSignatureVersion3.New(
        TAWSCredentials.New('key', 'secret', True)
      )
    )
  )
  .Buckets
  .Get('maven.jjw.com.br', '/')
  .Objects;  <<<<<< Exception: "Get Error: 403"

  obj := objs.Get('firebird-2.5.7-embedded.zip', '/releases/br/com/jjw/firebird/2.5.7/');
  obj.Stream.SaveToFile('firebird.zip');

  ShowMessage('OK');
end;  

[betonetotbo]

I tried to change the AWS_S3 URL to where my bucket is: s3-us-east-1.amazonaws.com

And now I get: Get Error: 500

[mdbs99]

Are you sure that your bucket is right?

  .Get('maven.jjw.com.br', '/')  <<< here
  .Objects;  <<<<<< Exception: "Get Error: 403"

[betonetotbo]

Yes. I already have an java application that uses this bucket too, to download files using the AWS SDK.

[mdbs99]

Please, try using TAWSSignatureVersion4 signature version.

[betonetotbo]

Have you an example?

[mdbs99]

You just need to change one class (from 3 to 4): And you should try to use version 1 as well.

  objs := TS3Service.New(
    TAWSClient.New(
      TAWSSignatureVersion3.New(   <<<< here
        TAWSCredentials.New('key', 'secret', True)
      )
    )
  )

[betonetotbo]

Exception continues, Get Error: 400 now!

How can I specify the region? My bucket is only on us-east-1

[betonetotbo]

I have debugged your code, and I'm receiving as response on GetBucket:

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>InvalidRequest</Code><Message>Missing required header for this request: x-amz-content-sha256</Message><RequestId>4325CD409BEEEC2A</RequestId><HostId>1x+g7ZgS0lsNDGx5HV2RNy5ZiZTM7tBjTEKPL4iK1GRQGpFh+4tMtiG2PhJOkxCfTb7lCt4UYDo=</HostId></Error>

[mdbs99]

The same error using 1 and 4 signature versions?

How can I specify the region? My bucket is only on us-east-1

That must be an improve to the lib. Nowadays it is just a const (please make an issue for it).

I have debugged your code, and I'm receiving as response on GetBucket [snip]

You must check which version Amazon AWS S3 is expecting now. This code is a "little bit old" and they might have changed something.

[betonetotbo]

https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

[mdbs99]

I cannot read right now... something new there?

You also must pay attention of this line in TAWSSignatureVersion4 class code:

DateFmt:= FormatDateTime('yyyymmdd', IncHour(Now, 3));

You should use an integer accordingly your UTC. The 3 works in Brazil.

[mdbs99]

You should use an integer accordingly your UTC. The 3 works in Brazil.

@betonetotbo let me know whether it worked and, please, creates an issue to set this UTC number too.

[betonetotbo]

I'm from brazil, and I don't changed any line of your code. I cannot make it download a simple file of my bucket.

[mdbs99]

Well, I need to do some tests... it always worked, though.

@almp1 is another guy that used to this lib in production code and has contributed a lot as well (he made the signature V4). Maybe he has some tip about this problem.

A side note: having an issue like yours, makes me to go back tp this code to improve it.

[betonetotbo]

@mdbs99 For a better understanding, in my case I have a bucket named maven.jjw.com.br and inside it I have a file on this path /releases/br/com/jjw/firebird/2.7.5/firebird-2.5.7-embedded.zip. Can you post a example how to download this file. I'm a little confused with IS3Buckets.Get and IS3Objects.Get (what to pass in second argument), take a look on my test code:

var
  objs: IS3Objects;
  obj: IS3Object;
begin
  objs := TS3Service.New(
    TAWSClient.New(
      TAWSSignatureVersion4.New(
        TAWSCredentials.New('key', 'secret', True)
      )
    )
  )
  .Buckets
  // IS3Buckets.get( BUCKET_NAME, ROOT_DIRECTORY_IN_BUCKET ) !?!?
  .Get('maven.jjw.com.br', 'releases')
  .Objects;

  // objs.get ( FILENAME , PATH_TO_FILE ) ???
  obj := objs.Get('firebird-2.5.7-embedded.zip', 'br/com/jjw/firebird/2.5.7');
  obj.Stream.SaveToFile('teste.zip');

[mdbs99]

@betonetotbo

IS3Buckets.get( BUCKET_NAME, ROOT_DIRECTORY_IN_BUCKET ) !?!?

The second argument is about "acl", "analytics", "cors", etc. But I've never used it because I've never needed those arguments. See https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketOps.html

objs.get ( FILENAME , PATH_TO_FILE ) ???

The same as above. See https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketOps.html

I can see now that this API is confused and must be refactored.

PS. I didn't have time to see this bug yet, but I didn't forget it.

[betonetotbo]

I tried to pass empty string to the both arguments and I continue to get http error 500.

var
  objs: IS3Objects;
  obj: IS3Object;
begin
  objs := TS3Service.New(
    TAWSClient.New(
      TAWSSignatureVersion4.New(
        TAWSCredentials.New('key', 'secret', True)
      )
    )
  )
  .Buckets
  .Get('maven.jjw.com.br', '')  >>> THROWS HTTP ERROR 500 and 400 when I didn't use SSL
  .Objects;

  obj := objs.Get('releases/br/com/jjw/firebird/2.5.7/firebird-2.5.7-embedded.zip', '');
  obj.Stream.SaveToFile('teste.zip');

[jwk72]

Anyone resolved this?

When I use TAWSSignatureVersion1 I get connected, but with TAWSSignatureVersion4 I get 403 forbidden.

My bucket is in eu-central-1 (changed URL to s3.eu-central-1.amazonaws.com in the source). Also used NowUTC() to get the right timestamp,

[mdbs99]

Guys, unfortunately I didn't have time to refactor AWS yet. I'm scheduling to back to it only in beginning of January/2019, since I have a lot to do in private projects until the end of this month. Sorry about that. However, project will be totally refactored to use better connections, log, etc.

[mdbs99]

Guys, I'm back. So, today I tried to use s3demo, without any modifications, to download and upload and it worked perfectly. This demo is using TAWSSignatureVersion1, though. That is the major problem? Anyway, I will fix version-4 also and refactor all code. Stay tuned.

Please, try using version 1 for now.