AWS FOTA using presigned URL from private S3 bucket

[Joe Boettcher]

Hello,

I've gotten the sample AWS FOTA to work on my nrf9160 using a very permissive public S3 bucket, but for production I need FOTAs to use a private S3 bucket.

According to https://devzone.nordicsemi.com/f/nordic-q-a/70753/aws-fota-download-from-s3-authentication/309614#309614, using presigned URLs is advised to allow for using a private S3 bucket. This makes sense; however, there is no documentation how to do this and I have not been able to get it to work. Would you simply append the query params to the path as shown below?

Example (failed) attempt at IoT Job using presigned URL:

{
  "operation": "app_fw_update",
  "fwversion": "v1.0.2",
  "size": 181124,
  "location": {
    "protocol": "http:",
    "host": "myfota-secure.s3.amazonaws.com",
    "path": "file_path?X-Amz-Algorithm=_____&X-Amz-Credential=____..."
  }
}

Thanks for the help

[Joe Boettcher]

I notice the only difference between my job document and yours is that your "location.path" contains a "X-Amz-Security-Token". Is this required? Maybe this is the reason my job request fails.

I cannot figure out how to create an aws presign url with "X-Amz-Security-Token" using the aws cli. Do you know how I could create one?

[Didrik Rokhaug]

The command I use is 'aws s3 presign <s3 uri>

[Joe Boettcher]

I use the same command and it does not provide a "X-Amz-Security-Token" for some reason. Is that necessary for FOTA's to not be "403 Forbidden"?

I think the problem might stem from IAM policies. I followed the instructions from https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/samples/nrf9160/aws_fota/README.html

My bucket policy looks like this:

{    "Version": "2012-10-17",
     "Statement": [
         {
             "Effect": "Allow",
             "Principal": "*",
             "Action": "s3:GetObject",
             "Resource": "arn:aws:s3:::bucket_name/*"
         }
      ]
 }

And my permission bucket settings look like this:

What are the permissions for your bucket?

[Didrik Rokhaug]

I accidentally had none of them blocked.

However, it also works for me if I block all public access.

A tip for debugging this issue, as long as you don't use TLS:

We recently published a preview of the Trace Collector V2, which not only let you capture modem traces, but also decode them.

Once decoded, you can inspect the IP traffic in Wireshark, and see exactly what AWS is returning. There is often some extra information in the body of the response.

This guide explains how to capture traces with the "old" trace collector.