AWS SDK What context do applications run in for ACL? - amazon-web-services

Question

We're using the AWS SDK (.net) and have successfully uploaded files through our program using PutObjectRequest. I know how to set the ACL permissions on the file once it's created, But when trying to Get the file using GetObjectRequest our application is getting "Access Denied". I realize that I don't know what the userID is for the application that's running. How can I make sure my application has the permissions needed to read the file, without using "public" rights? (setting the ACL on the file to public works for the application).
Is there a way to make the application retrieve a file AS a certain user or group?

Answer 1

Any AWS API call request, need an access key and secret key pair which can be set from:
Hard coded in the app,
AWS configuration file (by default it is in ~/.aws/credentials or C:\Users\*USERNAME*\.aws\credentials), or
Instance role for EC2 instances.
For the #1 and #2, you can check your IAM user permission in https://console.aws.amazon.com/iam/home?region=us-east-1#users.
For #3, you can check your IAM role in https://console.aws.amazon.com/iam/home?region=us-east-1#roles.
Make sure the user/role have enough permission to read your S3 object. You can attach this policy into the user/role:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1455021573875",
"Action": [
"s3:GetObject",
"s3:GetObjectAcl"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::your-bucket-name/*"
}
]
}
Adjust the above policy. Your app should have read object access now.
Btw, you can set ACL while creating a resource. You can find the documentation on http://docs.aws.amazon.com/AmazonS3/latest/dev/acl-using-dot-net-sdk.html.
static string bucketName = "*** Provide existing bucket name ***";
static string newBucketName = "*** Provide a name for a new bucket ***";
static string newKeyName = "*** Provide a name for a new key ***";
IAmazonS3 client;
client = new AmazonS3Client(Amazon.RegionEndpoint.USEast1);
// Retrieve ACL from one of the owner's buckets
S3AccessControlList acl = client.GetACL(new GetACLRequest
{
BucketName = bucketName,
}).AccessControlList;
// Describe grant for full control for owner.
S3Grant grant1 = new S3Grant
{
Grantee = new S3Grantee { CanonicalUser = acl.Owner.Id },
Permission = S3Permission.FULL_CONTROL
};
// Describe grant for write permission for the LogDelivery group.
S3Grant grant2 = new S3Grant
{
Grantee = new S3Grantee { URI = "http://acs.amazonaws.com/groups/s3/LogDelivery" },
Permission = S3Permission.WRITE
};
PutBucketRequest request = new PutBucketRequest()
{
BucketName = newBucketName,
BucketRegion = S3Region.US,
Grants = new List<S3Grant> { grant1, grant2 }
};
PutBucketResponse response = client.PutBucket(request);
PutObjectRequest objectRequest = new PutObjectRequest()
{
ContentBody = "Object data for simple put.",
BucketName = newBucketName,
Key = newKeyName,
Grants = new List<S3Grant> { grant1 }
};
PutObjectResponse objectResponse = client.PutObject(objectRequest);