0

For the life of me I can't figure out why I can't get opsworks to access the files in a bucket!

I have a chef 12 stack in opsworks. The repository is a zip file in an S3 bucket called "cheftest" (not real name) It grabs it no problem and starts to run setup recipe. During the setup it is supposed to grab 2 app files to install from the same "cheftest" bucket. It ONLY works when they are made public.

I'm trying 2 different methods, https and s3_file. Both won't work unless app files made public. http gets a 403 forbidden, s3_file will just wait until a timeout failure.

I've created bucket/role policies that allow access. Hell I've even given the instance role full access to all of S3 buckets and functions as a test, still no joy.

Now, I can successfully RDP into the windows instance, install the AWS CLI, and aws s3 cp the files!!! Whaaaaaaaaa??? So I know the IAM role has proper permissions to grab the files.

I'm beyond confused. Looking at AWS doc I don't see anything I've missed: https://docs.aws.amazon.com/opsworks/latest/userguide/using-s3-bucket.html

I have even tried giving the aws-opsworks-service-role access to the bucket!

Role Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:Get*",
        "s3:List*"
      ],
      "Resource": "arn:aws:s3:::cheftest/*"
    }
  ]
}

Bucket Policy:

{
"Version": "2008-10-17",
"Statement": [
    {
        "Sid": "Stmt1371012494444",
        "Effect": "Allow",
        "Principal": {
            "AWS": [
                "arn:aws:iam::<account>:role/WebServers",
                "arn:aws:iam::<account>:role/aws-opsworks-service-role.xxxxxxx"
                ]
        },
        "Action": [
            "s3:List*",
            "s3:Get*"
        ],
        "Resource": "arn:aws:s3:::cheftest/*"
    }
]
}

Okay, I've been holding back submitting this ticket on the odds I missed something silly. I have now taken the example cloudformation template from the above link 'using s3 bucket', created the recipes to use those roles/buckets and this still fails to get files unless public. But STILL can aws s3 cp the files when I RDP to instance.

What have I missed?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.