I'm following the docs on fetching certificates from s3 when a new instance is deployed to elastic beanstalk. The instructions are fairly straightforward: create a config file under
app-root/.ebextensions that reads:
Resources: AWSEBAutoScalingGroup: Metadata: AWS::CloudFormation::Authentication: S3Auth: type: "s3" buckets: ["elasticbeanstalk-us-west-2-123456789012"] roleName: "Fn::GetOptionSetting": Namespace: "aws:autoscaling:launchconfiguration" OptionName: "IamInstanceProfile" DefaultValue: "aws-elasticbeanstalk-ec2-role" files: # Private key /etc/pki/tls/certs/server.key: mode: "000400" owner: root group: root authentication: "S3Auth" source: https://s3-us-west-2.amazonaws.com/elasticbeanstalk-us-west-2-123456789012/server.key
where the links point to the location on your certificate / key / whatever.
However, when I deploy my application bundle (zip), the build fails with
[Errno 404] HTTP Error 404... suggesting that my files cannot be found at the specified location contrary to the fact that the files are at the precise specified location since I can
aws s3 cp s3://<pasted-link-to-file> . them from my command line (same region of course).
Also, on the surface, it doesn't seem to be a permissions problem because I'd expect something like "Access Denied" if it was; the bucket policy grants the following actions to
"Action": [ "s3:ListBucket", "s3:ListBucketVersions", "s3:GetObject", "s3:GetObjectVersion" ]
I also attached full s3 access policy to
aws-elasticbeanstalk-ec2-role in IAM.
But the fact that I can access the files from cli and
aws-elasticbeanstalk-ec2-role cannot find them, suggests that a) something could be wrong with my setup: files on s3, s3 permissions, config in
.ebextensions or b) aws docs on this matter are completely out of whack.
- This is a bit of a broad question but can anyone suggest what else could go wrong with this sort of setup?