Failed to load resource: the server responded with a status of 403 (forbidden) aws s3

Lightning Bit

unread,

Feb 5, 2021, 1:05:37 PM2/5/21

to Django users

Does anyone know how to bypass the 403 error on AWS S3 with Django where the static files are not allowed to show up on the site? 

Kasper Laudrup

unread,

Feb 5, 2021, 1:36:51 PM2/5/21

to

On 05/02/2021 06.05, Lightning Bit wrote:
> Does anyone know how to bypass the 403 error on AWS S3 with Django where
> the static files are not allowed to show up on the site?
>

Ah, yes. The 403 error we all heard of. Everyone knows how to bypass
that. Everyone except you.

Benny M

unread,

Feb 5, 2021, 2:06:35 PM2/5/21

to

Lightning,
I think what Kasper means to say is that there are a few reasons why AWS isn’t authorizing your request, and the likelihood that Django is somehow involved in that error is pretty much zero.

HTTP 403 means that some authorization/permission isn’t sufficient for the server to fulfill the request. Look into your AWS configs or contact their support team.

That said, I have no right to speak for Kasper, so my interpretation may, in itself, generate a 403.

> On Feb 4, 2021, at 11:36 PM, Kasper Laudrup <> wrote:

>
> On 05/02/2021 06.05, Lightning Bit wrote:
>> Does anyone know how to bypass the 403 error on AWS S3 with Django where the static files are not allowed to show up on the site?
>>
>
> Ah, yes. The 403 error we all heard of. Everyone knows how to bypass that. Everyone except you.
>

> --
> You received this message because you are subscribed to the Google Groups "Django users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to .
> To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/ff1118ea-b429-3264-5bea-8f8a01f245ef%40stacktrace.dk.

Kunal Solanke

unread,

Feb 5, 2021, 2:16:20 PM2/5/21

to

Well, still its first time I read him being sarcastic or kind of fed up.Its hilarious 🤣.


Aldian Fazrihady

unread,

Feb 5, 2021, 2:54:39 PM2/5/21

to

Everyone, Kasper's answer contains hint. Don't get offended.


Benny M

unread,

Feb 5, 2021, 3:24:29 PM2/5/21

to

> Well, still its first time I read him being sarcastic or kind of fed up.Its hilarious 🤣.

Sometimes hyperbole is the perfect solution. The smart ones realize they’re being lazy and make it a point to try some due diligence next time.

It worked on me. Soon as I started figuring out my own bugs, somebody started paying me for it.

OKKK This is a lot I think so here it goes.

I have a s3 bucket created that I am using to store user uploaded images and static css and js files. To use this bucket with django I have installed: django-storages and boto3. Documentation. Also I am kind of deployed on heroku but I'm still in DEBUG mode in settings.py.

I have these variables set up for accessing s3 (using environs for environment vars)

AWS_ACCESS_KEY_ID = env.str("AWS_ACCESS_KEY_ID") AWS_SECRET_ACCESS_KEY = env.str("AWS_SECRET_ACCESS_KEY") AWS_STORAGE_BUCKET_NAME = env.str("AWS_STORAGE_BUCKET_NAME") DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage' STATICFILES_STORAGE = 'storages.backends.s3boto3.S3StaticStorage'

Apparently this is supposed to grant me privilege's with using my s3 bucket in Django but it says this in the google dev console thing: Failed to load resource: the server responded with a status of 403 (Forbidden).

Over the last WEEK (please someone save me from this neverending torture), I have tried and heard many things:

  • I should use cloudfront as a cdn -- I don't understand how this applies to my use case

  • I have tried adding new bucket policies

  • I have tried adding new policies to my Iam user

  • I tried making everything in the bucket public! -- how would it still be forbidden??

    • I turned off Block all public access

    • Also enabled ACLS in Object Ownership -- idk what that does tbh.

Now let me show you all the policies and stuff I have added.

For the bucket::

Bucket Policy:

https://pastebin.com/EV3eir9S (Formatting on reddit sucks - look at the pastebin)

{ "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::root-user-id:user/Iam-user-name" }, "Action": [ "s3:PutObject", "s3:GetObjectAcl", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::bucketname/*", "arn:aws:s3:::bucketname" ] } ] }

CORS

https://pastebin.com/Br46XJew

[ { "AllowedHeaders": [ "*" ], "AllowedMethods": [ "PUT", "POST", "DELETE", "GET", "HEAD" ], "AllowedOrigins": [ "*" ], "ExposeHeaders": [ "x-amz-server-side-encryption", "x-amz-request-id", "x-amz-id-2" ] } ]

Now For the Iam User

Policies:

AWS S3 Full access

PleaseWorkPolicy(Inline Policy):

https://pastebin.com/RvWuhhaa

{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObjectAcl", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::bucketname/*", "arn:aws:s3:::bucketname" ] } ] }

Yes my security credentials are correct.

Wrap up

Please if anyone has any ideas I am in desperation mode. Some one once mentioned using s3 for static site hosting with cloud front but idk how that is necessary for my use case. I would be eternally grateful for any at all help in this desperation effort of mine.

Have a splendid Day :}

--programmer smile

How do I troubleshoot 403 Access Denied errors from Amazon S3?

How do I troubleshoot 403 Access Denied errors from Amazon S3?.
Use the AWS Systems Manager automation document. ... .
Check bucket and object ownership. ... .
Check the bucket policy or IAM user policies. ... .
Confirm that IAM permissions boundaries allow access to Amazon S3. ... .
Check the bucket's Amazon S3 Block Public Access settings..

When accessing a S3 bucket you get 403 Forbidden error What does it mean?

The "403 Forbidden" error can occur due to the following reasons: Permissions are missing for s3:PutObject to add an object or s3:PutObjectAcl to modify the object's ACL. You don't have permission to use an AWS Key Management Service (AWS KMS) key. There is an explicit deny statement in the bucket policy.

How do I fix an AWS S3 bucket policy and Public permissions access denied error?

To resolve these issues:.
Check that the IAM user or role has s3:Get:BucketPolicy permission to view the bucket policy and s3:PutBucketPolicy permission to edit it. ... .
If you're denied permissions, then use another IAM identity that has bucket access, and edit the bucket policy..

How do I fix 403 forbidden?

How to Fix the 403 Forbidden Error.
Check for URL errors and make sure you're specifying an actual web page file name and extension, not just a directory. ... .
Clear your browser's cache. ... .
Log in to the website, assuming it's possible and appropriate to do so..