Question on Upload to S3 using cURL and predefined URL - amazon-web-services

Question

I am looking for some assistance on uploading a zip file from an EC2 instance to an S3 bucket using a pre-signed URL. So far, I have a python lambda that creates an S3 bucket and generates a presigned URL (with bucket name and filename), I as well have assigned a custom policy to the bucket after creation (below) for perms to upload. When I SSH to the box and run "curl -X PUT -T filename -L 'PRESIGNED URL'" I am still getting an "Access Denied" error message. Any ideas would be greatly appreciated!
​
Lambda Code to generate presigned URL:
s3_url = s3client.generate_presigned_url('put_object', Params = {
'Bucket': new_s3_label,
'Key': filename
}, ExpiresIn=600)
​
Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PolicyForAllowUploadWithACL",
"Effect": "Allow",
"Principal": {
"AWS": "ACCOUNTID"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::BUCKETNAME/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}

Answer 1

The problem appears to be your CURL command doesn't have the s3:x-amz-acl request header to meet the policy condition.
A better way to upload from an EC2 to an S3 bucket is directly without Pre-Signed URLs.
IAM is much better security than pre-signed URLs, anytime you can do opt for IAM and least privilege principal.
When you spin up an EC2 you provide an IAM Role. It's this role that gives the EC2 permission to talk to other services, such as S3. You should add S3 write permissions into your AWS EC2s' IAM role. You can add the following IAM policy to the role:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "UploadToS3",
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::my-bucket/*"
}
]
}
Other permissions may be required such as KMS permissions if your bucket uses default KMS encryption.