Amazon access denied When trying to get the Bucket object list using java SDK

Question

I am using Amazon S3 to upload/download videos. I can upload any video but I cannot list my videos in the bucket because I got these errors:

03-30 11:51:06.911 28577-28734/com.video.apps3 I/CCC: Caught an AmazonServiceException, which means your request made it to Amazon S3, but was rejected with an error response for some reason.
03-30 11:51:06.911 28577-28734/com.video.apps3 I/CCC: Error Message:    Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: 4AEF68CB2979FBB9)
03-30 11:51:06.911 28577-28734/com.video.apps3 I/CCC: HTTP Status Code: 403
03-30 11:51:06.911 28577-28734/com.video.apps3 I/CCC: AWS Error Code:   AccessDenied
03-30 11:51:06.911 28577-28734/com.video.apps3 I/CCC: Error Type:       Client
03-30 11:51:06.911 28577-28734/com.video.apps3 I/CCC: Request ID:       4AEF68CB2979FBB9

I have a simple structure like this:

All Buckets/ myvideos/
  video1.mp4
  video2.mp4
  Other.mp4

I there is my policy for this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::myvideos/*"
            ]
        }
    ]
}

So I can upload videos to it but I cannot list the elements inside.

It is the piece of code I am using to list the objects.

try {
    ListObjectsRequest listObjectsRequest = new ListObjectsRequest()
            .withBucketName(MY_BUCKET)
            .withPrefix("")
            .withDelimiter("/");
    ObjectListing objectListing;
    do {
        objectListing = s3Client.listObjects(listObjectsRequest);
        for (S3ObjectSummary objectSummary :
                objectListing.getObjectSummaries()) {
            Log.i("CCC", " - " + objectSummary.getKey() + "  " +
                    "(size = " + objectSummary.getSize() +
                    ")");
        }
        listObjectsRequest.setMarker(objectListing.getNextMarker());
    } while (objectListing.isTruncated());
} catch (AmazonServiceException ase) {
    Log.i("CCC", "Caught an AmazonServiceException, " +
            "which means your request made it " +
            "to Amazon S3, but was rejected with an error response " +
            "for some reason.");    
    Log.i("CCC", "Error Message:    " + ase.getMessage());
    Log.i("CCC", "HTTP Status Code: " + ase.getStatusCode());
    Log.i("CCC", "AWS Error Code:   " + ase.getErrorCode());
    Log.i("CCC", "Error Type:       " + ase.getErrorType());
    Log.i("CCC", "Request ID:       " + ase.getRequestId());
} catch (AmazonClientException ace) {
    Log.i("CCC", "Caught an AmazonClientException, " +
            "which means the client encountered " +
            "an internal error while trying to communicate" +
            " with S3, " +
            "such as not being able to access the network.");
    Log.i("CCC", "Error Message: " + ace.getMessage());
}

I don't know what else do I need to do? How is possible that with the same access S3 allow me to upload but denied the list?

Update 1: Code

I was using this:

CognitoCachingCredentialsProvider credentialsProvider = 
    new CognitoCachingCredentialsProvider(
                context,
                IDENTITY_POOL_ID,
                MY_REGION
        );

AmazonS3  s3Client = new AmazonS3Client(credentialsProvider);

s3Client.setRegion(Region.getRegion(MY_REGION));

And so I tried with this:

AWSCredentials credentials = new BasicAWSCredentials(accessKey, secretKey);
AmazonS3 s3Client = new AmazonS3Client(credentials);

And ok, It works. But I want to allow the videos access for no loggin users. I don't wanna use my accessKey and secretKey.

Try to extend the policy to include the bucket itself: `"Resource": [ "arn:aws:s3:::myvideos/*", "arn:aws:s3:::myvideos" ]`. — Nicolas, Mar 30 '16 at 16:33

score 2 · Accepted Answer · answered Mar 30 '16 at 16:42

You need to grant access to the bucket for the ListBucket operation. In your policy, you are granting access to the files inside the bucket myvideos but not the bucket itself. Try this policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::myvideos",
                "arn:aws:s3:::myvideos/*"
            ]
        }
    ]
}

score 1 · Answer 2 · edited May 23 '17 at 12:15

1

To list the contents of the bucket add this to the policy

{
    "Effect": "Allow",
    "Action": [
         "s3:ListBucket"
     ],
    "Resource": [
          "arn:aws:s3:::myvideos/*"
     ]
}

Source

edited May 23 '17 at 12:15

Community

1
1

answered Mar 30 '16 at 16:26

Thiyagu

17,362
5
42
79

Amazon access denied When trying to get the Bucket object list using java SDK

Update 1: Code

2 Answers2