Accessing S3 from an external location using IAM user access keys

Question

I have used the javascript AWS-SDK to put a file on S3 via the putObject call. This works fine if I set the bucket to be public, but as soon as I turn off public access, it no longer works and I'm given a 403 error in the response.

I have created a security key against an IAM user, the IAM user is myself and I have sufficient access to S3 via the aws console, so I think my permission are correct.

Here is my code snippet, which works if the bucket is public;

const options = {
    region: AWS_REGION,
    accessKeyId: AWS_ACCESS_KEY,
    secretAccessKey: AWS_SERECT_KEY,
  };
  const filesAwaitingProcessing = getFilesAwaitingProcessing(FOLDER_ID);

  filesAwaitingProcessing.forEach((fileId) => {
    const dataFile = file.load({
      id: fileId
    });
    if (dataFile) {
      const s3 = new AWS.S3(options);
      let error = false;
      s3.putObject({
        Bucket: BUCKET,
        ACL: 'authenticated-read',
        ContentEncoding: 'UTF-8',
        ContentType: 'application/json',
        Key: `${BUCKET_DIRECTORY}/${dataFile.name}`,
        Body: dataFile.getContents()
      }, (err, data) => {
        if (err) {
          error = true;
          log.error(JSON.stringify(err), JSON.stringify(err));
        } else {
          log.debug(data);
        }
      });

      s3.getObject({
        Bucket: BUCKET,
        Key: `${BUCKET_DIRECTORY}/${dataFile.name}`
      }, (err, data) => {
        if (err) {
          error = true;
          log.error(err, err.stack);
        } else {
          log.debug(data);
        }
      });

Am I passing the key up correctly?

Or am I doing this completely the wrong way for secure access?

This is my bucket policy;

{
"Version": "2012-10-17",
"Id": "Policy1602780209612",
"Statement": [
    {
        "Sid": "Stmt1602780204129",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::619425574045:user/myUserName"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::dawson-group/processing"
    }
]

}

And then I have the full S3 policy against my user as well as a policy I created that related to just the bucket in question

Answer 1

So it appears that there was no issue with the actual code and bucket set up, the issue was the application we were trying to access S3 from. It is stripping the Authentication headers