Access Denied when downloading via Signed URLs - amazon-web-services

Question

I am using an IAM role to access S3 from my EC2 instance. But in my application, I create a signed URL for downloading the files. However, when the user tries to download the files, it is showing access denied errors.
var AWS = require('aws-sdk');
var s3 = new AWS.S3();
//key=file path
var params = {Bucket: bucket, Key: prefix+'/'+key, Expires: 240}
var url = s3.getSignedUrl('getObject', params)
console.log(req.cookies.s, 'got', url) // expires in 60 seconds
res.redirect(url)

Answer 1

The fact that you are providing Signed URLs and they result in an Access Denied error says that the Signed URL is not valid.
Some potential reasons:
The Signed URL was incorrectly constructed (you didn't show us your code, so we can't determine this)
The credentials used to generate the Signed URL does not have permission to access the objects (a Signed URL is a way to authorise temporary, limited usage of credentials, but the underlying credentials must have access to the resource)
The time period for the Signed URL expired (but this would result in a different error message)
The object does not exist (which is quite likely, since Access Denied suggests this, rather than displaying an error related to the Signed URL)

Answer 2

Thanks for #john 's answer to point out the main issue with the Access Deniedis that the signed URL is not valid.
I want to add another thing that helps sort this issue out. Even you don't have correct credentials to the bucket, you will still be able to generate the signed URL!
That's where it got me stuck, as I didn't think my credentials were not correct as I generated the URL successfully.

Answer 3

My problem was other, so maybe I can help someone.
What I was lacking was the Permissions for the Lambda to use the S3 Bucket. I added this to the template where the LambdaFunction is defined:
Properties:
Policies:
- AWSLambdaVPCAccessExecutionRole
- AWSLambdaBasicExecutionRole
- S3CrudPolicy:
BucketName: !Ref MyS3Bucket
(the last 2 lines are the important! I just put all the policies for reference...)