# Comments for Upload a File to S3 **URL:** \ **Category:** Chapter Comments\ **Created:** [May 9, 2018, 7:40pm UTC](https://discourse.sst.dev/t/comments-for-upload-a-file-to-s3/123 "2018-05-09T19:40:30Z")\ **Posts on this page:** 20\ **Page:** 1

**Author:** ![anomalyinnovations](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/anomalyinnovations/32/10_2.png) [@anomalyinnovations](https://discourse.sst.dev/u/anomalyinnovations)\ **Post date:** [May 9, 2018, 7:40pm UTC](https://discourse.sst.dev/t/comments-for-upload-a-file-to-s3/123/1 "2018-05-09T19:40:30Z")

_From @jayair on Mon Apr 10 2017 01:05:55 GMT+0000 (UTC)_ Link to chapter - [http://serverless-stack.com/chapters/upload-a-file-to-s3.html](http://serverless-stack.com/chapters/upload-a-file-to-s3.html) _Copied from original issue: [https://github.com/AnomalyInnovations/serverless-stack-com/issues/49](https://github.com/AnomalyInnovations/serverless-stack-com/issues/49)_ ---

_From @geirman on Sat Apr 15 2017 22:44:05 GMT+0000 (UTC)_ I see the following 400 error in my dev console (Network \> XHR) under the name `?max-keys=0`. I’ve searched my code for ‘us-east-1’ and find zero results. I’ve converted all those instances to ‘us-east-2’ to match values I got back from aws. Not too sure what is causing this, and initially was concerned, but after checking the database…everything seems to have inserted into DynamoDB and uploaded to S3 correctly. ¯\_(ツ)_/¯ ```auto AuthorizationHeaderMalformed The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'us-west-1' us-west-1 39E99C1D42C6E600 tfuC/uhW4xhxPwMW+kqicWQxCdTznTrsYpM+lr40QGIyriIFysywMKlnnKqOGIKQ88SqN7SxWxE= ``` ![2017-04-15_1609](https://canada1.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/e97af1497498a09a4dfafbaca7e973d6e99f8cee.png) ---

_From @jayair on Sun Apr 16 2017 01:06:57 GMT+0000 (UTC)_ @geirman still having this issue? I noticed you commented on the Delete Note chapter. ---

_From @geirman on Sun Apr 16 2017 01:15:34 GMT+0000 (UTC)_ Yes, it has something to do with the S3 upload. It works, but I get the error each time I attach something. No error when I just update the comment. ---

_From @jayair on Sun Apr 16 2017 02:09:45 GMT+0000 (UTC)_ You get the error every time you create a new note with a file as an attachment? But the file is uploaded successfully? That’s strange. Where are you seeing this error? ```xml AuthorizationHeaderMalformed The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'us-west-1' us-west-1 39E99C1D42C6E600 tfuC/uhW4xhxPwMW+kqicWQxCdTznTrsYpM+lr40QGIyriIFysywMKlnnKqOGIKQ88SqN7SxWxE= ``` ---

_From @geirman on Sun Apr 16 2017 06:34:32 GMT+0000 (UTC)_ Everytime I create or update a note with and attach something. It’s successfully uploaded though, which I agree seems strange. So it’s not gating me. Would be nice to understand why it’s happening though. I found the error under Networking \> XHR \> click on the item with a 400 error `?max-keys=0` \> Preview \> then expand the Error node. ![2017-04-15_2330](https://yyz2.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/2f258aa5f85ace81036933fb2bcfa65b77d24fc4.png) It’s deployed now, so you can see for yourself… [http://notes-app-client-geirman.s3-website-us-east-1.amazonaws.com/](http://notes-app-client-geirman.s3-website-us-east-1.amazonaws.com/) ---

_From @jayair on Mon Apr 17 2017 17:38:39 GMT+0000 (UTC)_ I played around with your app. I think I know what’s going on. The AWS JS SDK has a region set to `us-east-1` but your S3 file uploads bucket is in `us-west-1`. Apparently, the SDK retries with the correct region, hence it ends up working. You can set the correct region before you do the upload by doing so. ```auto const s3 = new AWS.S3({ region: 'us-west-1', params: { Bucket: config.s3.BUCKET, } }); ``` The tutorial doesn’t need to do this because region set for the AWS JS SDK using the `AWS.config.update({ region: config.cognito.REGION });` call is the same for the S3 file uploads bucket. You can read more about here - [https://github.com/aws/aws-sdk-js/issues/986#issuecomment-217017283](https://github.com/aws/aws-sdk-js/issues/986#issuecomment-217017283) ---

_From @geirman on Mon Apr 17 2017 19:13:53 GMT+0000 (UTC)_ Thanks @jayair, you’ve been a huge help. Setting the region to ‘us-west-1’ does resolve the problem, but I can’t for the life of me figure out how that makes any sense. Everything I’m seeing indicates that the region should be ‘us-east-2’. I tried ‘us-east-2’ for giggles, but it errored as well. Where should I have been looking to know that ‘us-west-1’ was the right value? ![2017-04-17_1113](https://yyz2.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/577cadcaab62499d027fb9c50450af48edecf9d8.png) ---

_From @jayair on Mon Apr 17 2017 21:08:55 GMT+0000 (UTC)_ What about the bucket that you set up for file uploads? The one we do in this chapter - [http://serverless-stack.com/chapters/create-an-s3-bucket-for-file-uploads.html](http://serverless-stack.com/chapters/create-an-s3-bucket-for-file-uploads.html) ---

_From @geirman on Mon Apr 17 2017 21:32:03 GMT+0000 (UTC)_ That’s the one ---

_From @jayair on Tue Apr 18 2017 17:29:48 GMT+0000 (UTC)_ Thanks. I don’t think the region in the URL for the AWS Console is the region of the bucket. The console does show the correct region either in the list of buckets or in the bucket page. You can see it here in this screenshot. ![select-created-s3-bucket](https://yyz2.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/a0b5f1234880b5d7e43c34f35092cf1f1c1659d7.png) And here is the US East (N. Virginia) - `us-east-1` mapping [http://docs.aws.amazon.com/general/latest/gr/rande.html#s3\_region](http://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region) ---

_From @nerdguru on Wed Apr 19 2017 22:28:49 GMT+0000 (UTC)_ I’m getting a 403 on the PUT and rechecked my CORS settings on the bucket, which look OK. What else should I be looking at to troubleshoot here? ---

_From @geirman on Thu Apr 20 2017 16:52:47 GMT+0000 (UTC)_ @jayair Good call! The region thing seems like an important detail to AWS, but it gets in the way from my perspective. I wish we could abstract it away. ![image](https://yyz2.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/b7ed37aa02183d525af6fb6783a52db5b097f39b.png) I created a codestar project this morning and as I was checking it out, I went back to my aws console and navigated back to it… and it was gone! I was confused, so I created another. Both seemed to work, so I kept scratching my head and figured out that my demo 1 was in a different region. Not sure why I switched regions, but it’s a confusing detail that I continually seem to stumble on. (sorry to get off topic) ![image](https://yyz2.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/37c5178994e3aa9413fa69297203baea7c8311cc.png) ---

_From @jayair on Thu Apr 20 2017 18:24:03 GMT+0000 (UTC)_ @nerdguru can I see the full error? I think you can expand the 403 error in the console and it might give you some info on why it’s failing. Also, let’s see what the url endpoint is for the PUT request. @geirman yeah in future we might look into building something that would hopefully abstract out these details and gotchas. If you come across some ideas, send them our way 😉 ---

_From @nerdguru on Thu Apr 20 2017 20:46:25 GMT+0000 (UTC)_ @jayair Here’s what gets output in the Chrome console: [pete-notes-app.s3.amazonaws.com/us-east-1%3A636ea0f9-5d92-41f2-86eb-93aa67b66968-1492639359454-addams.txt:1](http://pete-notes-app.s3.amazonaws.com/us-east-1%3A636ea0f9-5d92-41f2-86eb-93aa67b66968-1492639359454-addams.txt:1) PUT [https://pete-notes-app.s3.amazonaws.com/us-east-1%3A636ea0f9-5d92-41f2-86eb-93aa67b66968-1492639359454-addams.txt](https://pete-notes-app.s3.amazonaws.com/us-east-1%3A636ea0f9-5d92-41f2-86eb-93aa67b66968-1492639359454-addams.txt) 403 (Forbidden) That path looks right to me, but you’re eyes might reveal something ---

_From @abagasra98 on Fri Apr 21 2017 04:22:10 GMT+0000 (UTC)_ @nerdguru I had the same problem. AWS throws a 403 error because the user permissions associated with the authorized users (of your identity pool) does not grant them access to read/write S3 data. The solution is to go into the IAM console, go to **Roles** tab on the side, click on the one associated with your Identity pool. For reference, mine was called “_Cognito\_notesidentitypoolAuth\_Role_” After you’re on the **Summary** page, click _attach policy_ and choose the following: **AmazonS3FullAccess** ---

_From @fwang on Fri Apr 21 2017 18:33:58 GMT+0000 (UTC)_ @abagasra98 is correct in that lack of S3 upload permission can cause the 403 error. Granting the identity pool with **AmazonS3FullAccess** solves the problem, but it also grants a user access to edit/remove files uploaded by other users. A very subtle tweak to the solution is to grant users edit/remove access only to files they uploaded. @nerdguru Let’s first take a look at the IAM policies assigned to the identity pool. As @abagasra98 suggested, go to **IAM console** , click on **Roles** in the left menu, click on **Cognito\_notesidentitypoolAuth\_Role** , click on **Show Policy** near the bottom of the page. ---

_From @nerdguru on Thu Apr 27 2017 01:01:53 GMT+0000 (UTC)_ @abagasra98 and @fwang, that was it, thanks so much. I clearly missed that step when setting up the Identity Pool. I changed that policy to the one shown on that step and now it works like a champ. My .txt file I selected in the app shows up with the expected prefixed name in my bucket. Sorry it took me so long to find the quiet time to try it out 8) ---

_From @alpiepho on Thu May 11 2017 10:47:42 GMT+0000 (UTC)_ @jayair add the Amazons3FullAccess policy allows me to upload files now. Two questions: 1. I didn’t follow comment from @fwang. Is there a way to tighten that access? (details would be appreciated) 2. did I miss a step in the tutorial? Thanks for all the help here. ---

_From @fwang on Thu May 11 2017 23:28:18 GMT+0000 (UTC)_ @alpiepho the policy allowing the Identity Pool to access S3 resources was defined in [Create a Cognito Identity Pool](http://serverless-stack.com/chapters/create-a-cognito-identity-pool.html) chapter. When the Identity Pool was first created, we attached the following policy: ```auto { "Version": "2012-10-17", "Statement": [ ..., { "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::YOUR_S3_UPLOADS_BUCKET_NAME/${cognito-identity.amazonaws.com:sub}*" ] } ] } ``` This grants access to `YOUR_S3_UPLOADS_BUCKET_NAME` bucket, and files prefixed with the users’ identity in the bucket. [Next page](https://discourse.sst.dev/t/comments-for-upload-a-file-to-s3/123.md?page=2)