1

I am writing a powershell script to download a file from an s3 url. I keep getting a (403) Forbidden error. The command i use is

Invoke-WebRequest -Uri "http://bucketname.s3.amazonaws.com/file.txt"

The EC2 instance has an IAM role associated with it that has access to download from the s3 bucket. I am able to run commands (cp, ls, etc.) with the aws cli successfully. Is this an issue with the credentials I am passing with the request? Do I need to pass AWS credentials with this request?

Preston Martin
  • 2,789
  • 3
  • 26
  • 42

1 Answers1

3

When you use the Invoke-WebRequest cmdlet the way you are, you are not passing credentials to S3. So even though you're on an EC2 instance authorized to download the file, Amazon S3 does not know it.

When using the AWS CLI, it sends the credentials along with the request.

You have a few options:

  1. Make the file public in S3. This would allow your cmdlet to work as-is. But then anyone would be able to download it.
  2. Use the AWS SDK to download the file instead. As you mentioned, it's working fine.
  3. Use the AWS SDK to generate a pre-signed URL, then you can use Invoke-WebRequest with that pre-signed URL to download the file.
  4. Send credentials with your Invoke-WebRequest call. I would not recommend this because you're just reinventing the wheel.
Matt Houser
  • 33,983
  • 6
  • 70
  • 88