Why am I getting botocore.exceptions.ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden?

Question

I'm getting this traceback when trying run run manage.py collectstatic as part of an AWS ElasticbeanStalk deploy using an S3 bucket.

  File "./src/manage.py", line 10, in <module>
  execute_from_command_line(sys.argv)
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/core/management/__init__.py", line 381, in execute_from_command_line
  utility.execute()
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/core/management/__init__.py", line 375, in execute
  self.fetch_command(subcommand).run_from_argv(self.argv)
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/core/management/base.py", line 316, in run_from_argv
  self.execute(*args, **cmd_options)
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/core/management/base.py", line 353, in execute
  output = self.handle(*args, **options)
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/contrib/staticfiles/management/commands/collectstatic.py", line 162, in handle
  if self.is_local_storage() and self.storage.location:
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/contrib/staticfiles/management/commands/collectstatic.py", line 216, in is_local_storage
  return isinstance(self.storage, FileSystemStorage)
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/utils/functional.py", line 213, in inner
  self._setup()
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/contrib/staticfiles/storage.py", line 491, in _setup
  self._wrapped = get_storage_class(settings.STATICFILES_STORAGE)()
  File "/opt/python/bundle/3/app/src/core/storage.py", line 64, in __init__
  super(StaticStorage, self).__init__(*args, **kwargs)
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/contrib/staticfiles/storage.py", line 376, in __init__
  self.hashed_files = self.load_manifest()
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/contrib/staticfiles/storage.py", line 386, in load_manifest
  content = self.read_manifest()
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/contrib/staticfiles/storage.py", line 380, in read_manifest
  with self.open(self.manifest_name) as manifest:
  File "/opt/python/run/venv/local/lib64/python3.6/site-packages/django/core/files/storage.py", line 33, in open
  return self._open(name, mode)
  File "/opt/python/run/venv/local/lib/python3.6/site-packages/storages/backends/s3boto3.py", line 464, in _open
  f = S3Boto3StorageFile(name, mode, self)
  File "/opt/python/run/venv/local/lib/python3.6/site-packages/storages/backends/s3boto3.py", line 72, in __init__
  self.obj.load()
  File "/opt/python/run/venv/local/lib/python3.6/site-packages/boto3/resources/factory.py", line 505, in do_action
  response = action(self, *args, **kwargs)
  File "/opt/python/run/venv/local/lib/python3.6/site-packages/boto3/resources/action.py", line 83, in __call__
  response = getattr(parent.meta.client, operation_name)(**params)
  File "/opt/python/run/venv/local/lib/python3.6/site-packages/botocore/client.py", line 357, in _api_call
  return self._make_api_call(operation_name, kwargs)
  File "/opt/python/run/venv/local/lib/python3.6/site-packages/botocore/client.py", line 661, in _make_api_call
  raise error_class(parsed_response, operation_name)
  botocore.exceptions.ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden
   (ElasticBeanstalk::ExternalInvocationError)

I have permissions on the bucket set to Public read write (just trying to get it working) so I do not understand the error.

Any help much appreciated

EDIT

I've added the following bucket policy which I think should give access. Same error:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListObjectsInBucket",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Principal": "*",
            "Resource": [
                "arn:aws:s3:::my-bucket-name"
            ]
        },
        {
            "Sid": "AllObjectActions",
            "Effect": "Allow",
            "Action": "s3:*Object",
            "Principal": "*",
            "Resource": [
                "arn:aws:s3:::my-bucket-name/*"
            ]
        }, ,
        {
            "Sid": "PublicWrite",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket-name/*"
            ]
        }
    ] }

try this https://stackoverflow.com/questions/36144757/aws-cli-s3-a-client-error-403-occurred-when-calling-the-headobject-operation — shafik, Dec 07 '19 at 09:02
I don't think this is the issue because ElasticBeanstalk and the current EC2 instance are in the same region (and S3 doesn't have regions). Also, the account is set up to always open in eu-west-2 (when the ElasticBeanstalk instance is). But if it is the issue how do I force ElasticBeanstalk to create the EC2 instance in eu-west-2? — HenryM, Dec 07 '19 at 09:06
You didn't have permission that is the point. How did you ensure you have it? Have you assigned an IAM role or by using API key? For the public test, have you set the correct bucket policy? without that, it will not gonna be public. — Lamanus, Dec 07 '19 at 09:21
@ArunmainthanKamalanathan available in these regions US East (Northern Virginia) Asia Pacific (Tokyo) EU (Ireland) US West (Oregon) US West (Northern California) — shafik, Dec 07 '19 at 09:46
@shafik - are you saying I have to have the eb instance in one of those regions? — HenryM, Dec 07 '19 at 09:53
Check ur aws configuration is accessible by only root user or not. Then check your aws credential is right or not. This is just permission related issue. — shafik, Dec 07 '19 at 10:39
Got it - it was a permissions problem. I had updated the region in the code but I had not committed the code so it was putting up an old version — HenryM, Dec 07 '19 at 10:59

score -2 · Accepted Answer · answered Dec 07 '19 at 11:10

-2

Ensure you've committed your code to the code repository before deploying it

answered Dec 07 '19 at 11:10

HenryM

5,557
7
49
105

3

The actual answer as described in the comments to the question is that it's a permissions issue. – Noumenon Oct 09 '21 at 16:21

Why am I getting botocore.exceptions.ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden?

1 Answers1