bucket restriction using SAM

[jkellndorfer]

We successfully used SAM to deploy, but are unsure how to restrict the use to a specific bucket. We used the Bucket section to give it a bucket name, and it shows in the parameters of the stack, but the service still can be accessed with data on other buckets. Is there a specific syntax to list the bucket resstrictions when using SAM?

[vincentsarago]

in SAM, the bucket should be , (coma) delimited list of bucket, so something like `"sentinel-2-l2-cogs,landsat-collection2"

ref: https://github.com/lambgeo/titiler-layer/blob/main/sam.yml#L56-L73

I guess you can check the IAM role that the SAM application creates to make sure of this.

if you can still access S3:// url outside the bucket list well have no idea what's going on :-(

[jkellndorfer]

Thanks for the pointer to the IAM role. Turns out there is an error in the policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:GetObject",
                "s3:HeadObject"
            ],
            "Resource": [
                "arn:aws:s3:::mybucket/*"
            ],
            "Effect": "Allow"
        }
    ]
}

The error message at the bottom is : Invalid Action: The action s3:HeadObject does not exist. Did you mean s3:GetObject? The API called HeadObject authorizes against the IAM action s3:GetObject.`

But even after taking out the s3:HeadObject Action, I can still access other public buckets just fine.

[vincentsarago]

feel free to open an issue in titiler-layer 🙏

[jkellndorfer]

ok, I'll do a little more exploring and shall open an issue in titiler-layer.

[rsignell-usgs]

@jkellndorfer, took me a while to find it: https://github.com/lambgeo/titiler-layer/issues

[vincentsarago]

FYI the Lambda Layer and SAM application code is now over https://github.com/developmentseed/titiler-lambda-layer

[gtnbssn]

I just deployed the SAM application, and am having a very similar issue.

I have opened an issue in the relevant repo, there did not seem to be one, even in the closed issues.