1

I'm getting an "Access denied by target host" error when attempting to connect to S3 with Assets.

In order to troubleshoot further, I've added a var_dump around line 238 in third_party/assets/sources/s3/lib/S3.php:

        if ($rest->error !== false)
        {
            self::__triggerError(sprintf("S3::listBuckets(): [%s] %s", $rest->error['code'],
                $rest->error['message']), __FILE__, __LINE__);

                var_dump($rest);

            return false;
        }

When attempting to refresh the bucket list in Assets via the EE control panel, I can now see the details of the error:

object(stdClass)#162 (3) { ["error"]=> array(2) { ["code"]=> string(12) "AccessDenied" ["message"]=> string(13) "Access Denied" } ["code"]=> int(403) ["headers"]=> array(1) { ["type"]=> string(15) "application/xml" } } Access denied by target host. 

Summary: Amazon's response is "Access Denied"

I thought my credentials may have been to blame, but, editing either key changed the error message, so, that wasn't the problem in this instance.

Using the OS X file transfer app Transmit, I was able to connect to S3 with the same credentials, list files, upload a file, and then view it via the publicly accessible URL, so that ruled out configuration/policy issues on Amazon's end.

Upon further testing with Transmit, I found that I could get the same "Access Denied" error if I omitted the "path" (which is the same thing as the bucket name) setting when I attempted to connect - it appeared that our policy of not allowing the user to perform a list-buckets command was the problem. Is it possible to hard code the bucket name somehow?

1

Assets recently added support for setting bucket names in config.php, like this:

   $config['assets_source_settings'] = array(
      1 => array (
        'access_key_id' => 'key-id-goes-here',
        'secret_access_key' => 'secret-key-goes-here',
        'bucket' => 'bucket-name-goes-here' 
      )
    );

That by itself should be sufficient to get past an S3 policy that doesn't allow listing buckets.

| improve this answer | |
-1

I think the issue is perhaps with your server time. It's the solution to the top two Google results for this error at least:

https://forums.aws.amazon.com/message.jspa?messageID=449702#

and

Assets stopped connecting to Amazon S3, Access denied by target host

| improve this answer | |
  • I promise I google before I post ;-) Per our var_dump, the error is "Access Denied," not the time offset message as described in the other posts. – Nick Benson Oct 23 '13 at 3:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.