AWS Integration Error : Access Denied When Uploading Images

Python SDK
,
1

Hi all, I am trying to import images from my s3 bucket into my Labelbox dataset. I followed the instructions from this post: How to: AWS S3 Integration with Labelbox
and from the docs site: Amazon S3

When I try to upload files using the Python SDK, task.error returns: “Failed to access URL: 403:Forbidden”. I see this from the Labelbox end:
image

If I allow all public access to the bucket through a policy, the labeling works but when I try to restrict it to only the Labelbox AWS account, it returns access denied on my files.

Wondering if there is anything I am missing. Thanks!

2

Hi Dan,

I noticed a typo in the policy description.
Make sure that your policy is configured with the following:

    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::<BucketName>/*",
                "arn:aws:s3:::<BucketName>"
            ]
        }
    ]
}

Example:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::test-bucket/*",
                "arn:aws:s3:::test-bucket"
            ]
        }
    ]
}

Best regards,

Paul N.
Labelbox Support

1 Like
3

Hey Paul,

Thanks for the quick response. That is the format of my policy but I am still unable to reach the images from Labelbox. I also gave the Labelbox role full s3 access just to see if it would work and was still unable to access. I also disabled all public blockers to the s3 and added a policy to the bucket:
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Sid”: “LabelboxAccess”,
“Effect”: “Allow”,
“Principal”: {
“AWS”: “arn:aws:iam::Labelbox AWS Account ID:root”
},
“Action”: “s3:GetObject”,
“Resource”: “arn:aws:s3:::bucket name/*”
}
]
}

Thanks,
Daniel

4

Hi @dageorge1111,

To confirm, the following error message is displayed if the policies are not configured to get the objects from the bucket or list its content. Another case would be if assets are deleted in the bucket but not in Catalog.

image

Since you mentioned that the access works with public access, it suggests something is wrong with the bucket’s permissions.

Note that the required policies for IAM integrations are:

  • s3:GetObject
  • s3:ListBucket

For Cloud Integration, an extra permission, s3:GetBucketLocation is required.

Best regards,

Paul N.
Labelbox Support

Visit the Labelbox Community: https://community.labelbox.com