presignedGetObjectUrl url is not accepted by S3 (permanentRedirect)

[themmes]

Hi,

First of all thanks for making this library, I've successfully used it to push data to S3.

Problem I have is with presignedGetObjectUrl, it generates an URL like this:

https://s3.amazonaws.com/<bucket>/<path>?<auth>

But I’m getting a permanent redirect from AWS saying it should be

https://<bucket>.s3.amazonaws.com/<path>?<auth>

Am I using it wrong or is this a bug?

Thanks in advance!

[harshavardhana]

Make sure you allow us to do GetBucketLocation() to get the region or please set the right region to generate correct presigned URL

[themmes]

I was under the impression that I did set the region, for context this is my code

s3signUrl :: Text -> IO (Maybe Text)
s3signUrl url = do
  awsConn <- awsCI
             |> setRegion Config.awsRegion
             |> setCredsFrom [fromAWSEnv]
  res <- runMinio awsConn $ do
    presignedGetObjectUrl Config.awsS3Bucket url (3600*2) [] []

  pure case res of
    Left _ -> Nothing
    Right signedUrl -> Just (cs signedUrl)

[themmes]

I've just verified by running the aws cli aws s3api get-bucket-location --bucket <bucket_name> that returns the bucket location. Is that what you mean with allowing you to do GetBucketLocation()? I've also set the environment variable AWS_DEFAULT_REGION to the right region. Is there still something I'm missing?

[donatello]

Thanks for your report @themmes - we will send a fix for it. The presign URL code does not do anything special for AWS at this time, but we will fix this.

[themmes]

@donatello Thanks for getting back to me this quickly!

So there is some bug causing this? Let me know if I can help.

Is there any temporary fix I could use on my end to work around it? I've tried hacking the URL to match the expected format, but S3 seems to reject the signature, so I might have broken it by changing the url.

[harshavardhana]

Thanks for your report @themmes - we will send a fix for it. The presign URL code does not do anything special for AWS at this time, but we will fix this.

The main thing is we need to use the region to generate the pre-signed URL for AWS because buckets cannot be referenced with https://s3.amazonaws.com they need to be put into virtual bucket DNS style.

So this looks like a bug in minio-hs at this point.