Search code examples
amazon-web-servicesfog

Fog, S3 and iam instance profile: Excon Forbidden


I am trying to list the contents of an S3 bucket with Fog, but get constant errors:

The request signature we calculated does not match the signature you provided. Check your key and signing method.

Details of the setup

EC2 Instance

IAM Role "S3BucketAccess":

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:Get*",
        "s3:List*"
      ],
      "Resource": [
        "arn:aws:s3:::*",
        "arn:aws:s3:::mybucket/*",
        "arn:aws:s3:::mybucket/deploy",
        "arn:aws:s3:::mybucket/deploy/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "arn:aws:s3:::*"
    }
  ]
}

169.254.169.254/latest/meta-data/iam/security-credentials/S3BucketAccess

{
  "Code" : "Success",
  "LastUpdated" : "2013-06-28T11:54:08Z",
  "Type" : "AWS-HMAC",
  "AccessKeyId" : "XXXXXXXXXX",
  "SecretAccessKey" : "YYYYYYYYYY",
  "Token" : "ALongToken",
  "Expiration" : "2013-06-28T18:15:09Z"
}

The Ruby code:

require 'rubygems'
require 'fog'
connection = Fog::Storage::AWS.new({:use_iam_profile => true})
p connection.directories

Get a nasty error message / stack trace with the above mentioned error code.


Solution

  • fog 1.14.0 was published on 07-19-2013 which has the resolution (issue 1923 is a result of https://github.com/fog/fog/pull/1940). The update resolves the issue.