Aws-sdk-php: Request via aws cli client works fine but using PHP SDK fails with 403 clientError Forbidden

[liquorvicar]

This is my first exposure to AWS so forgive me if I've missed something obvious but I can't seem to get the PHP SDK to work.

I have installed the Python CLI client and can upload Objects fine like this:
aws s3 cp test.txt s3://my.bucket/
I have verified that the file is there via the AWS website control panel.

Now when I try the same action using the PHP SDK, like so:

<?php
// Require the Composer autoloader.
require '../vendor/autoload.php';

use Aws\S3\S3Client;

// Instantiate an Amazon S3 client.
$s3 = new S3Client([
    'version' => 'latest',
    'region'  => 'eu-west-1'
]);

try {
    $s3->putObject([
        'Bucket' => 'my.bucket',
        'Key'    => 'test.txt',
        'Body'   => fopen('test.txt', 'r'),
        'ACL'    => 'public-read',
    ]);
} catch (Aws\Exception\S3Exception $e) {
    echo "There was an error uploading the file.\n";
    echo $e->getMessage() . "\n";
    echo $e->getTraceAsString();
}

then I get the following error:
Aws\S3\Exception\S3Exception: Error executing "PutObject" on "https://s3-eu-west-1.amazonaws.com/my.bucket/test.txt"; AWS HTTP error: Client error: 403 AccessDenied (client): Access Denied

Any ideas where I might be going wrong??

[liquorvicar]

Ok, I have resolved the immediate issue by adding the IAM account I was using to a group we had set up. But that still doesn't really explain why it wasn't working via the PHP SDK as without that change it was working via the python CLI tool.

[jeskew]

You would normally see a 403 when you're using the wrong credentials. Are you using environment variables, an ini file, or the EC2 metadata service?

The most common cause of this error is that PHP tends to be run by a webserver, which has a different user account and therefore a different home directory. This would mean that the CLI would pick up the /home/<cli-user>/.aws/credentials file while your PHP would pick up the /home/<fpm-user>/.aws/credentials file. If no credentials file exists in the home directory of the server user, the SDK will attempt to pull an IAM role from the EC2 instance.

[liquorvicar]

I set up the credentials using the python CLI client (as per here http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html). I understand that has stored my creds in ini files in my home dir. I am running the python CLI client and my test php script from my local machine using the same user. One is working and one isn't.

[jeskew]

I believe the CLI's cp command defaults to an ACL of 'private', so your user might not have had permission to create 'public-read' objects (which you're doing in the PHP sample) until after you added it to the group. In any case, the PHP sample required higher permissions than did the python script.

[liquorvicar]

@jeskew That was it. Thanks for your help.