Having trouble with POST request for uploading S3 objects

Question

I have a Lambda written in python3 that generates two URLs: one presigned post URL, and another presigned URL for getting the S3 HTML hosted in the same bucket from that post URL response. Here's the form content that I generate an HTML file for the presigned POST URL: ``` ``` where `upload_form_url` is the response from a `generate_presigned_post`. I think it's probably not related to the form itself, but I still wanted to show it. The error I get when uploading the file on this form is: ``` InvalidAccessKeyId The AWS Access Key Id you provided does not exist in our records. xxxxxxxxxxx ..... ...... ``` which is probably more related to how I'm generating credentials. I get this regardless of whether I'm executing this on the cloud or locally. But for the life of me, I cannot figure out what I'm doing wrong. I'm tried assuming a role, I've tried setting up different session, but I keep getting this same key ID error. This is how I'm setting up the boto3 client, as of my latest attempt: ``` session = boto3.Session( aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"], aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"], aws_session_token=os.environ["AWS_SESSION_TOKEN"] ) s3_client=session.client('s3') ``` I also read online that the access key ID must start with AKIA, instead of ASIA, but all access key IDs start with ASIA. Maybe that's where I'm going wrong? I'm really not sure, and I'd appreciate any help. Thanks in advances

Riku_Kobayashi · Answer

Hello.

Access keys starting with "ASIA" are temporary access keys issued in STS events.  
https://docs.aws.amazon.com/STS/latest/APIReference/API_GetAccessKeyInfo.html

If you are issuing a signed URL with Lambda, an IAM role will be used, so there is no need to set an access key in the code.  
```
session = boto3.Session(
    aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"],
    aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"],
    aws_session_token=os.environ["AWS_SESSION_TOKEN"]
)
```

By the way, is the request successful with a "curl" command using a URL created with Lambda instead of an HTML form?  
In my environment, I have confirmed that I can create a URL using the Lambda below and upload it using the curl command.  
```
import boto3

s3_client = boto3.client('s3',region_name="ap-northeast-1",endpoint_url="https://s3.ap-northeast-1.amazonaws.com")

def lambda_handler(event, context):
    url = s3_client.generate_presigned_post(
        Bucket="bucket-name",
        Key="test.txt",
        Conditions=[
            {
                "acl":"public-read"
            }
        ],
        ExpiresIn=3600
    )
    print(url)
    return url
```
The response looks like this:  
```
{
  "url": "https://s3.ap-northeast-1.amazonaws.com/bucket-name",
  "fields": {
    "key": "test",
    "AWSAccessKeyId": "ASIAxxxxxxxxx",
    "x-amz-security-token": "xxxxxxxxxxxxxx",
    "policy": "xxxxxxxxxxxxxxx",
    "signature": "xxxxxxxxxxxx"
  }
}
```

The curl command looks like this:  
```
curl -X POST https://s3.ap-northeast-1.amazonaws.com/bucket-name \
-F 'key=test' \
-F 'acl=public-read' \
-F 'AWSAccessKeyId=ASIAxxxxxx' \
-F 'policy=xxxxxxxx' \
-F 'x-amz-security-token=xxxxxx' \
-F 'signature=xxxxxxxxx=' \
-F file=@kobayashi.txt
```

Having trouble with POST request for uploading S3 objects

Add your answer

Relevant content