Access Denied with presigned GET URLs using ExAws.S3 and Tigris

[jwesonga]

I’m building an image uploader that uses Tigris S3 and using ExAWS.S3, I noticed that if I generate a presigned GET url I keep getting an access denied:

<Error>
<Code>AccessDenied</Code>
<Message>Access Denied.</Message>
<Resource>/02d579ee-b430-4ffa-aaa0-cb0c09631437.jpg</Resource>
<RequestId>1733430038018995328</RequestId>
<Key>02d579ee-b430-4ffa-aaa0-cb0c09631437.jpg</Key>
<BucketName>my-bucket</BucketName>
</Error>

My code looks like this:

opts = Keyword.merge([expires_in: 3600],opts)
ExAws.Config.new(:s3) |> ExAws.S3.presigned_url(:get,"<bucket name from ENV>", "02d579ee-b430-4ffa-aaa0-cb0c09631437.jpg", opts)

The URL is also very different from what Tigris generates in their web app. Using ExAWS the URL is:
https://fly.storage.tigris.dev/{bucket}/{object}

But from Tigris it’s:
https://{bucket}.fly.storage.tigris.dev/{object}

I’ve tried swapping the URLs but still get access denied. The same API call using an S3 bucket and object generates a presigned URL that works, no issues. What am I doing wrong?

[jmj]

Hi @jwesonga

Can you share the URL it generates? You can redact the sensitive values but keep the query param keys as is.

[jwesonga]

Just gave this a try this morning and the generated URLs are working fine, tried it with several uploaded images and it works! Maybe it was an intermittent issue?

[jmj]

We didn’t have any issue that could cause this. Glad it is working fine. Let us know if you have any other question.