S3 Backup not working with EC2 IAM

Support Self-hosting
,
1

I think i have searched and worked through all the topics and tutorials on this matter.

I am always getting this error when trying to open the Backups page:

Error while trying to load /admin/backups.json

When i open /admin/backups.json i only get a generic Access Denied error

What i don’t understand is, that using the follow commands in my EC2 Instance is working properly:

aws s3 ls s3://my-bucket-name

and when going into the discourse container with ./launcher enter app i can run this also successfully after installing s3cmd:

s3cmd ls s3://my-bucket-name

I can also upload stuff into my bucket using this commands therefore the IAM policy should be fine and I cannot understand why Discourse cannot access the bucket. I also tried to add “AdministratorAccess” to the IAM role to rule out any too tight permission problems.

Configuration in Discourse:

backup location: S3
s3 backup bucket: my-bucket-name
s3 use iam profile: true
s3 region: the correct one. tripple checked.

The remaining s3 options are left untouched → Therefore mostly empty/disabled.

Any idea what could go wrong?

Thanks!

2

I’m not sure this would have anything to do with your S3 settings, it sounds like an internal Discourse permissions message. Are you able to load /admin/backups as a page (rather than appending .json to the end)?

3

Easiest way to debug problems like this is checking the Cloudtrail logs.

4

This was an awesome hint. I could trace down the permission error and could see that Discourse was using a different user. Now to the big why and why nobody had this error before.

We have a custom plugin for sending Push Notifications through AWS SNS which was setting credentials through Aws.config.update globally and therefore S3 Backup seems to also have been using the wrong credentials that obviously did not have the required permissions.

We will now fix our plugin to locally provide the credentials/region and support EC2 IAM roles which i am preferring at this point :slight_smile:

Thanks for the push in the right direction!

paresy