S3 generate_presigned_post problem with Multi Region Access Point

[hoonki-kim]

I tried to generate a presigned post url using a Multi Region Access Point like this and received a success response.

presigned_url = s3.generate_presigned_post(
            Bucket="arn:aws:s3::{{my_id}}:accesspoint/{{my_mrap_id}}",
            Key="test.aaa",
            Conditions=[
                ["content-length-range", 1, 10000]
            ],
            ExpiresIn=expire
        )

but using response data, post api call failed with this response.

<?xml version="1.0" encoding="UTF-8"?>
<Error>
    <Code>AccessDenied</Code>
    <Message>Invalid according to Policy: Policy Condition failed: ["eq", "$bucket", "arn:aws:s3::{{my_id}}:accesspoint/{{my_mrap_id}}"]</Message>
    <RequestId>KDEE4ZVQRDYQGEZD</RequestId>
    <HostId>...</HostId>
</Error>

i tried add conditions like this, but all failed.

["starts-with", "$bucket", ""] // too allow any

or 

["eq", "$bucket", ""], // to allows any 

i think in botocore signers.py code this point , it seems that the bucket name passed to mrap arn has a fixed effect on the policy.

    params = {'Bucket': bucket} # line 781
    bucket_is_arn = ArnParser.is_arn(params.get('Bucket', '')) # line 782

Can you give me some solution?

Same Problem In Stack Overflow Thread Not Solved : https://stackoverflow.com/questions/71415180/how-to-use-sdk-generated-presigned-s3-urls-with-multi-region-access-points

[RyanFitzSimmonsAK]

Hi @hoonki-kim, thanks for reaching out. I had some trouble reproducing this behavior; could you provide debug logs (with sensitive info redacted) and maybe more information about your POST API call? You can get debug logs by adding boto3.set_stream_logger('') to your script. Thanks!

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.

[ArturIRE]

Hello @hoonki-kim, I had similar, but different issues. Disclaimer though, I am no expert on boto or S3.
I found the most straight forward way to use Access Points (multi-region or regular) with boto's generate_presigned_post(...) is to:

1. Generate the pre-signed post using the original Bucket name (not the Access Point ARN or alias)
2. Replace the the URL that was returned from generate_presigned_post(...) with one that uses the Access Point alias, but keep all the other returned fields as is

Example:

import boto3

# It seems you must configure the s3 boto client to use v4 signatures
# if you intend to upload via the Access Point alias (which we will)
s3_client = boto3.client("s3", config=Config(signature_version="v4"))

# we will create the pre-signed post using the original Bucket name (not Access Point arn/alias)
bucket_name = "myawsbucket"
upload_details = s3_client.generate_presigned_post(Bucket=bucket_name, Key="test.txt", ExpiresIn=30)

# Create the url we will use to upload from the Access Point alias
my_mrap = "abcdefghijklm.mrap"
access_point_url = f"https://{my_mrap}.accesspoint.s3-global.amazonaws.com/"

with open('./test.txt', 'rb') as file_to_upload:
    files = {'file': ('./test.txt', file_to_upload)}
    upload_response = requests.post(access_point_url, data=upload_details['fields'], files=files)

print(upload_response.status_code, upload_response.content)

Like you, I also tried using the Access Point ARN initially, but since mine was a regular Access Point and not a multi-region one I couldn't even call generate_presigned_post(...) successfully like you are doing because it would raise an exception on this line: https://github.com/boto/botocore/blob/develop/botocore/signers.py#L815
So I tried implementing my own version of that method by changing the argument to operation_model() to something like "PutObject" instead of "CreateBucket", but then I would have problems with the URL that was generated containing query parameters that needed to be removed. It eventually worked but was hacky and I found the simpler method described above.